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2023

1.1 March

1.1.1 Exposing the "PDF Botnet" - An OSINT Analysis (2023-03-03 20:34)

[1]

Dear blog readers,

I’ve recently stumbled upon a pretty interesting and worth mentioning malicious software and botnet spam and malicious software serving campaign that can be best described as a "PDF

botnet" where the ultimate idea for both propagation and infection is the active utilization of PDF files which are exclusively hosted on compromised or on purposely malicious and fraudulent rogue and bogus infrastructure.

Sample screenshots include:

7





[2]

[3]

[4]

[5]

Sample URLs known to have been involved in the campaign include: hxxp:[/][/]ragaz[.]co[.]za[/]XSRYdR1H?utm _term=picsart+background+image++hd 8

hxxp:[/][/]www[.]lbtfilm[.]com[/]uploads[/]files [/]koxuwegemagobuwidewas[.]pdf hxxp:[/][/]teputire[.]weebly[.]com[/]uploads[/]1[/ ]3[/]0[/]8[/]130813428[/]tixok[.]pdf hxxp:[/][/]www[.]hypnotiseur[.]com[/]wp-content[/]plu

gins[/]formcraft[/]file-

upload[/]server[/]content[/]files[ /]16210e2f2aed0f—favagujegelivos[.]pdf hxxp:[/][/]applecentervn[.]com[/]uploads[/]image[/]fi les[/]81922078809[.]pdf hxxp:[/][/]villamishkan[.]com[/]310renonew[/]front[/] images[/]files[/]womosutilonotolil[.]pdf hxxp:[/][/]jackinthegymtpe[.]com[/]uploads[/]files[/] 202204101711569256[.]pdf hxxp:[/][/]jigupipugefelo[.]weebly[.]com[/]uploads[/] 1[/]3[/]4[/]3[/]134387822[/]kexowanegakuxiku[.]p df

hxxp:[/][/]ulicetwojegomiasta[.]pl[/]kcfinder[/]upload[ /]files[/]vadanetezukamiludi[.]pdf hxxp:[/][/]toys4boysleather[.]com[/]userfiles[/]file[/ ]7982175874[.]pdf hxxp:[/][/]93564497[.]com[/]userfiles[/]texanefimewakat ovatoz[.]pdf hxxp:[/][/]ceb[.]lk[/]assets[/]js[/]kcfinder[/]up load[/]files[/]58252873057[.]pdf hxxp:[/][/]glassinter[.]de[/]kcfinder[/]upload[/]uplo ad[/]23524790716[.]pdf hxxp:[/][/]jaxurevinul[.]weebly[.]com[/]uploads[/]1[ /]3[/]4[/]8[/]134868463[/]3f2975c6121556[.]pdf hxxp:[/][/]szm[.]hu[/]userfiles[/]file[/]wenutoxew orudif[.]pdf

hxxp:[/][/]dojexivosofu[.]weebly[.]com[/]uploads[/]1 [/]3[/]4[/]3[/]134348646[/]6486123[.]pdf hxxp:[/][/]veraschwemmle[.]de[/]fckdata[/]file[/]dugi visoxolel[.]pdf hxxp:[/][/]happycondo[.]leaddeehub[.]com[/]userfiles[/ ]files[/]lipefagajetelegusir[.]pdf hxxp:[/][/]ninofupefuf[.]weebly[.]com[/]uploads[/]1[

/]3[/]1[/]8[/]13-

1856131[/]6e401701aa[.]pdf

hxxp:[/][/]www[.]auditsi[.]com[/]wp-content[/]plugins

[/]formcraft[/]file-

upload[/]server[/]content[/]files[/] 1622914d312f84—45312087428[.]pdf hxxp:[/][/]www[.]christinemartin[.]co[.]uk[/]wp-conte

nt[/]plugins[/]formcraft[/]file-

upload[/]server[/]content[ /]files[/]1621dac28b28a0—tufupavokuj[.]pdf hxxp:[/][/]sendedianqi[.]com[/]upload _fck[/]file[/]2022-3-21[/]20220321161426543141[.]pdf hxxp:[/][/]erdelyironkbutor[.]hu[/]admin[/]kcfinde

r[/]upload[/]files[/]sukotigipapewefowu[.-

]pdf

hxxp:[/][/]studioingegneriavaragnolo[.]com[/]userfiles[/] files[/]kilukowap[.]pdf hxxp:[/][/]f-kcc[.]jp[/]user _data[/]userfiles[/]files[/]22156092393[.]pdf hxxp:[/][/]alkoplast[.]rs[/]files[/]28560168304[.]pdf

hxxp:[/][/]arborspringsforestry[.]com[/]img[/]files[/] kelagug[.]pdf hxxp:[/][/]cissud[.]it[/]uploads[/]ck _editor[/]files[/]33956310758[.]pdf hxxp:[/][/]jfd[.]news[/]app[/]webroot[/]uploads [/]files[/]71167178402[.]pdf hxxp:[/][/]leg-vein[.]jp[/]kcfinder[/]upload[/]files [/]sevavimelozojufezetowe[.]pdf hxxp:[/][/]duxotitur[.]weebly[.]com[/]uploads[/]1[/ ]3[/]4[/]5[/]134596147[/]5545494[.]pdf hxxp:[/][/]tree-house[.]jp[/]assets[/]news[/]files[ /]tevasurodajaxajezetatug[.]pdf 9

hxxp:[/][/]kikebazelagugez[.]weebly[.]com[/]uploads[/] 1[/]4[/]1[/]2[/]141287616[/]77fd513b304b[.]

pdf

Sample MD5s known to have been involved in the campaign include: 5BB96B309B8CB58071B73118D1A59C05 1278967687.pdf

6E3EB89CFD46D107905D9F60853E2661 1410845058.pdf

0CF4455F92A6397521FC9BD08FC70A12 1487091430.pdf

20DA43AD4878B9F925F88854574010E2 1983674347.pdf

8C2E4E0C3EB5E0131324CA54FD1648BE 3480745958.pdf

23C45840B8F4EEF5F53CD35BC087D299 3552074133.pdf

9DA1E72A18F214555449BA3F8EBD1399 3964667732.pdf

879332C060A637B45E958911B84627B0 4092425255.pdf

A409086CDEF2B6C412B33EA8B53E70AD 4474449835.pdf

A4BB4C77DF8328AE46CEED4F373D2C1C 5741836759.pdf

B2EB74B29686039C6DCAAD0B801A125E 6103190089.pdf

342D15A9D8A9CAC6C482EF24C63FB7FF 6497559623.pdf

53A8F7A614EAC9833F0CC5B97AE8650A 8742646775.pdf

82D26DA61A8A0F389664859B38ECC08C 8791363493.pdf

99B141C2A8E5073C17E81E144734A361 8983036096.pdf

AD4C11FEFBE2A16AE8358BC51A8CBF3F 9120465087.pdf

C9A7E18ACBF4EE0ED5435B73E1957A9F 9231960459.pdf

699553341D62FBC0C1EE86266865DE72 9348069038.pdf

FBFE529A50E15B66DD40829525E7F7BA 9699229203.pdf

63BB161319E4E3584821D861AB541A0C 10348572906.pdf

BB568F6CD8AE515EAD55259470298D9E 13416475440.pdf

16E42D227211DAC5260BD8FD15A795C7 13823887193.pdf

3C1CE3A5A0B49D5AA198F0279889D493 13847861787.pdf

66BD8B8E665AC62A0FA67F111256541F 14137532633.pdf

B16E989493AD266A39A123629EADD229 14318140657.pdf

01373CA6F7533D66BF5A57390F9FFA31 16011902586.pdf

5A5AA084699C1415D962E0D59E637815 16634552211.pdf

511EEB37D73F3A001A9BB2D7640FA699 16906517497.pdf

9C6FF15B179AB97DCA523A26C1DD94CC 16956540666.pdf

BC09DFB24FF84BFAEC4606F78ED13795 19309202684.pdf

DBD8A6D7FD0898ED0DF40243E1AAAAF3 19351352124.pdf

B4F88922DC09879A1497D90F8C35017D 19470278438.pdf

CB954B8C3DCF9F2401777255F261175F 19942463577.pdf
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E3682885AD809552467EA6D31B72F161 20762845009.pdf

94417B7921DEEC6DFDAF998D60092C0A 20935069756.pdf

3B268B1A3007FE1CC7CF6C0DA4BB48D8 21512890984.pdf

0A50635185BD60EEC67121B6DA3ABA53 23074157543.pdf

0A30EB2A19F0B8BFB9B88F4EF05ED6F5 23192983959.pdf

A475775F774BC3BE647E773651CF7D55 23413321203.pdf

40EB5082EF96374B980381926703D5F8 23662198111.pdf

789B95F9DB6CAA4936B34D3CEB67812A 24028260079.pdf

34089FC75CFDD5C13521F50946F4A60F 24383278820.pdf

703A35F8A9783257633289A8112CA8EE 24570234767.pdf

C571B477784EA78362C75E0C80BC52E5 24576678480.pdf

7A6D9DA541454F316BE5833F540A661A 25012047289.pdf
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0F2635F30FD4270D4FA9706B32896725 sizaw.pdf

B766957A9351390006A4DDEE03CEC752 sokob.pdf

BDCE8F42F091FB484BF6257C9090F798 soxefimopiwedapu.pdf

254B17F8FAE0BC21521B1D44F88079F7 sugebugawe.pdf

E1F8423312128B6A369D8B8BDD5BD0E4 sujodudafiwuzagafif.pdf

A8C2630960AE5F59761492C054A524CF tamokogo.pdf

8C49FD8ABF0D06686BC12EDC0ECAF515 tanedit.pdf

68EA092CC212DA5FF3DC56EB48DD3F15 taponezujuguwixubar.pdf

38AA488AB67149EF80D475DA976BAB65 taxudibaziboxipumugi.pdf

278F92F9FAF63AA20F475DD45EAAB911 tebeb.pdf

DBB64861E70625B8C82F02C24E664A9F tebebenajoratitamuligumad.pdf

785049554CD0D758EA597775304F8584 tefebe.pdf

73181E8DD3125BE93389F4541E43F036 tekunesigananefutu.pdf

CCFFEC50A239AFFF257F050A01755096 telebufabexawugefepe.pdf

31F25B50CBB3B6E259DB4FF61880F20A temepuxu.pdf

F1AC09354C3FBBADAE782C9623FB636B tesojemepotatuzu.pdf

8A0E31809DFF80BC1005B5544B1DC322 tewarabebobedujofog.pdf

472DEE27FFC499D45C947EA729415B66 texoxabix.pdf

82FE07ABB7E80319D4CFE5A59E10F75B tidezukesolaxekuposotixuj.pdf

5B093C89AD7E7EC7A73EB0DB4F5E786F tikowosatipisugifuxomugu.pdf

110B8A742E56E442386AD7811934D42F tinedigaditutena.pdf

5D332E5896319EC3BDF5912BF767FF03 tirimuwopus.pdf

F82E2AFCEB3C73BD8FA88A69C50C3FB0 tivovo.pdf

3488F74380A72907C32E323AC30CF5B1 tixupevupatuma.pdf

09F7BE11CDC03A23A69818642945DF74 tonaduxepibexokaru.pdf

1AF119176830A01605A4F3D666B03423 toxavotix.pdf

F7F3B49A753839CEE2F4BC8B61FF6B18 tudaginaf.pdf

12144E0A34F8DFF88E1375E8BCCC17C5 vasafasiguwupefelapafuf.pdf

4A9171B3C178BB7766D8BDAE816F50CE vatudanupenikan.pdf

3BD07741A0D273221421971B1E5B1027 vedolelowo.pdf

5EBB24366ECDEBC73B59DD24E70C0D84 vefixosixaxokojefidelap.pdf

AA1FE8D8B6A482F9F04C908FA75EAB8B viredekax.pdf

052A40B14E6AC010F8D0E6C666BB5D3C vosubud.pdf
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FCE128DBC0D9CFD48540BB3514DC840D vupidatofopekuvis.pdf 9D9AF684A772ECAC45137E01B78C7667 vuviputupixun.pdf

F0FBD75C0F739E1F08D57FB7A2F6A533 wavopinirogo.pdf

E82D1D9357A8141D6CC5BFA8E9F32F21 wawumabexotazu.pdf

51F5F6E026DE0EBEB747AE558DE5DEDF waxuwenometanu.pdf

1BBAF1AE95A5833EFBE94DC2BBB79BA6 wesemapojano.pdf

7EDB292ED3F2E19135FF62D111E8E144 wetuxujererekuzu.pdf

615444D7A210491EEECB3ADCE6EB109D wevanudedupi.pdf

A5E160B07C37D4B47A382C0435B0634F wezalevuvisokipuxi.pdf

0DECD4479B267E5BBB37332FED90F825 wiguxi.pdf

9DF7FC5D28A1A1600966C4719DC9F75D wisamiwodivaxepew.pdf

C5273244B624352AA8E19D8CF403E17C wojoluxekab.pdf

21B3570649053CAF8D5AF91A8165BB5A wolibajobamajuputaxapov.pdf

F251EB18D2EC7ABEEC2B390E45E75966 wowivinezo.pdf

D9109FBC53ECC659169F05D3DD7B2AAD wufegonogibiporojef.pdf

83D52F6B6BE9D4091109E820178435E7 xafexazozod.pdf

3C724E2E7C84868C5F4D67ABFABBBE89 xajemavajosuxemepawamalob.pdf

40D4A927A0E086431ACA5C2085E64044 xajeseniravudum.pdf

8EF15BC5EBEB99F30DEA0443FCD6EC44 xaligokubogilegerewit.pdf

E5C951D7D00F82257848D9B32C2CAB69 xanona.pdf

8EB3C48DA38BE3A5B6134FB81248D6FA xegozanu.pdf

7FD6EC1EB5183A0C1F1AD7787BC88866 xegukiguwipemagepamipi.pdf

3676B2436F5DC22024E0B9120AFB30BD xelaperepef.pdf

2808A6181A41B5B530D09FC9793F1872 xikupigivemuvu.pdf

3D8C2D8BD1984B4054C10232197B00A3 xogipopoferixavaferov.pdf

D751706B295A39AB430D08AB8941F4A5 xolawukixemojakedape.pdf

A44FE0258F26C5C5BD6F47E7AC841383 xumerozitazefiwil.pdf

D7506730A7858D5B293B9F54DAFC0E91 zegolorufula.pdf

B79AE9AB464594F348B37F1E83FC991A zemuzafosodomebonudomuvat.pdf

388FB0258DA09D8C9922AAAA1BB721D6 zetewafolajepugo.pdf

56D3AD953D817869D766AF5F7E10CA55 zifefavix.pdf

3C402B886B6E4C0BD8CC89312687B455 zivawore.pdf

10C54DA100008DA2E4B11F53C220D762 ziwukoxib.pdf

A629DF34D816C4B0ABB81D7A61A86FD7 zizal.pdf

5513B8A5636095F4AFD591525ECD72BC zolijorakozone.pdf
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8E8151279699A3DF787731FA3226930C zomenuduvokag.pdf A07587C5E7E01CBF1AFAC7A469E5AA35 zoreveniwivopopalu.pdf

1F33F74DA311FAB0EA269FD657028409 zuludajafikoraketojesafaz.pdf

3A5C49EF0EE9090979E902ACC936BAD0 zunanegewafo.pdf

FCCFA12E0AD95A7E5CC62E2355160CF5 267343834.pdf

E0ADAA6C8DE2FA8CBC434A3D0475E8F2 974628066.pdf

CA9D188A3ED0984F5787535ADACF5EFA 985373609.pdf

11F9E844F718A30AEC3AD7BB39F984C9 1012580328.pdf

Stay tuned!

1. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiOtoPrGr1Brmf18iXXhjXBEJ3NCjcDfW19O_ofLIqN9igX4

DvI00UCOALrKVGC0o9QgzCh9sNttzmJ6djy3CEXNG8i8lXDHM6hriG

2. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgbk2LS3gtO8vjDnxA8BqAxcU17vJKqmBwYhVYUkJMA36vt6

6qVOm3n0xB-bbG2eWeWtfFe-vy3KbKlqmGvjv_9-YMFj_bEvyOQqTR

3. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhE9m2b3hRbPk4-4giU0LLw5HVvUWz6AMzVdtKrSqzaEEkls

_s5ButxJUlQnmLYF6sTeHVN8N4osyKrbWuMuBCxrMpcaVsj5pQRDRB

4. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhHJ72HrN9kOEZkHotdUQK2-mYtWLJHRTq7KAKtmhNUBaNhu

66kQ-ROD9ZPSEUwzo7NbW1iyRSIGTD9nR4IbslguD60DGLXtfHDXcM

5. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgqdGbbYAj96hb7Z7JYYFMwq0utDK2jRM_zMGnUpcAGltYXO

CZ3aVZ3tK37cTL7jnOYftoxoH43IqkdytEgFrcE_FvWjfDT1JS74w0

1.1.2 Clustering Phishing Campaign’s Rogue and Fraudulent and Malicious Hosting Infrastructure Pointing to Massive IPFS Web 3.0 Hosting Infrastructure Abuse

- An OSINT Analysis (2023-03-04 19:24)

[1]
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Dear blog readers,

I’ve recently stumbled upon a pretty interesting phishing campaign including the actual hosting infrastructure behind the campaign where I’ve decided to share my findings with everyone in particular the fact that the campaign including several other which I’ll profile in this post are currently hosted on Ipfs’s Web 3.0 infrastructure.

Sample screenshots include:

[2]
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[3]
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Sampe URL redirection chain:

hxxp://trustwave-ibank[.]com/l/LiinkedInhardest/900/ -> hxxp://kit[.]fontawesome[.]com/585b05125-1[.]js (b5a82299925ac96a1454732ab97f2bb5) - 104[.]18[.]23[.]52

Related MD5s known to have been dropping the same identical phishing infrastructure javascript obfuscation script include:

00666c31b9016602ffe0eae49a5e4ee5d4a079ad101c8e70aa1cdd2295e3937f

009710a0792b2f8dda23bee9f79644b3b19d092962d09aec19eff04d217d1f94

01db44f671d5b9e2ed3ca4a7f2e9d58d9887fd28d54d5b1d531e14ba8df47f6e

03026db9bd10d9d980923a457f2774497a34c96bea1ebf7cb74f13383af2271c

03763ee4d8e0d5e495fc8966702f3933f8f1547b25804038ab89acab01cb67df

03c186b5d249f5c9ded786871d5cc99130ce8c24c54bf8151868ee03c2db0a6a

04527364ea88ac8a81af4e4c0da13221fc31fac2d17ff73e11ecdaa8975b9596

0497603023cec2168783ec0a9d29e5b9f0d3e40e6b832b205892fcab82bbd0ed

04ee5db7857c070cde6a99962fd71d9d0f4bf5a23a5203605b0f23e10de649d3

067e21f3b35b0fa5ac87c47b6b87b3f5e8f14928e8028fba92b79a29c404a84d

086d54913106d49ceced058de30b80732cb57b68b9bf1ad75e0535fe48a737f8
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099afbc81e7c19775fc09a26d75b10997e36ae0fe23dd078c131a963fce15896

09cdc9b2be4d497be6c3392ff2cdc8a2145498a568110c99cb2d285945d8a3c9

0c5cd0f3718725137d566f1892ff4c3aaa4ef31dcec98ca932f7315306352144

0d5aa9847cb1cada491651830baf32a7b255464bca14fc787663a55cdb02e3c6

0ec1d2ca6f2f015f2440cf6b16ec8fab91208b23524d93f77b7734189590abc7

0fb5d884ea6cde5c7b4bb5ae590a0971f7cb2ae6e9d110d89b1c57b006d13a81

11c6248d01c2c52fd93f4e1676ede5afe332b32303db5e4d4b813285c2fc2a25

11cb76d18eb86a1a55b2d6d0da43c361501a67826b9bf43b774a5bfbf3b6a203

12c6f1f85e3a0bae45a13e8fa70c37a35782fd8ed4a05eb35e4704c0a0e09105

12f06ca666f09b7dda09f399896024e3344fe19d243dacd7eb2698ca9bb94530

1300a1f6e068d2362b958a53ee4ded3e6ed7b63b04649d3f8a708d8ce5e33ca0

14922a4bc2884913ab6e57b1965e82181b06cac1b6261c3a16475a4fbd3735ce

15449d0dc1b76471fc269cdaa37d2e5f10fb812f417d5d271b7aefc63e6ae137

15ac93c9c5be20926f8b58084d71900c3e846abaf053a54bee19db41a6c709da

15ff41a7b686de66a8cb47dbf37006966dd81b5148ca352532b605551a0c6a0e

1806f6e00b38287c20d58104a7d3728223e4171f57f3b36844e178d44995dc0f

1846902858f655ea58b601568aa80ecbf1b54bceba87875dd01dccad75918e36

1882fa1bed2a53a486dc07f4eb1858e6b9233402ef0f7b475246102189e8a405

19915d17f3bb2c2f6cba6d7c8f70fdc1d3793d811d5d6ee21e9253b17fc24c1a

19ecf0308f99a39fcc1124c6b67a486f43b10460e4810eef69089267d69edb09

1a0b8de3d820d16121d6435726b496bd281b2537e83b2ee8ec5fcceb87f2a623

1ab79910d98da1afabe2e982392b5c71ba5a28d6396cb5d49570f0bc06b595d2

1c7cf6889ff637ed4d2148122235f9b44367d3b1ba4305ae2b2e126ba26147c9

1d94581a181cd2c1be0d6329936c715a6cd39fb2a09d912de95699c37527ae41

1dd547317b93f57528fa914c0cf791eeb396736fe8876132680cc39f3dc77d2c

1e85b60b46b9683a64e466785a5bf429025aa651cf7a84765740eef7deffaf8d

1eb4424393a6f3846816f47cf68012de2f8407d5b1f9a93f67c1b620f3eab3de

1ec05ec963b867ad5df3e8deba62ac3d35b5ec8d5064fc541f848a863dedfd6e

1f9123ec02d098965c87ff2d24ab0b1b6bebf1ee5be4505896717f5b8762c924

2022f9b2f554dd627190f25f3873e9bc83ae3a8222f8cbeeb3944ca14c5a78b0

205c0eac682985f26e8e0a365dbd7341f9b14ca7c43f0c969da861f0163bffdc

20b9787348f3c6cf47aa38e61125563adc32fa5d849c87f7409b60e23c59f510

212a8b969ddc4dee979b49c95255fcc6a7ef8c53c61f3298730a69ae724d239b

215ff84fb3036e712bd0d12f088ee233153f4fb12508100e08230372e33d44f2

21b748624f3a1e051a500d58ba040da5f8b2ea70a8532b6d088b1a2c07b75ecc
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21e9c9d74b660ea8bf9cf36e7dfd436df609392127a7fd2d25e4a73eda7e6ca6

222b8e161cbc5fba915d20ed6c3f0c6f7526ca97890d8c24597ce545b1e212fb

232ecd1594f1bc189386283aec3f58a0faecca1dd1104c80a65b54a379716c87

2337b867ba75be2ec6f1875c936c334e690e70803836f228218b373c59af2fcc

2468c116fbc5bb5d655cffeffd719713ae452acd1e3c78bd2c9feb095cd5cbe8

2490346bab166bda27784aeb6abfb901ec8c31886352d977c5d0536c678b43fc

25add11d66040c5756d6e1cee59bc3e9c5ecd14ca4dd5b0c9ed991b933898c07

25f587f9293cf6df19255c64eb29614331201b3b47072195ee0cdda55826d534

2663c11155339c9da783a558efa38c25f428aa86bb5399c25f1eb1d25e732f97

26819f449dbfd75ebf2bbb5b6cf21229fd938d057771a9fd74ac28409111d2a0

26b2c8ceb1d451d1e93ff1c6229b777e77616abd07b64bac2559c18af267f1c2

29344e7092d7812f3e3d66223245b28258cceca3aef7450446094f2a4afe43a6

294a220cfa3675df66875b81e671600b72a00089bc7fc533c38bba972b83df40

2a48ea40bda49df5299b61352a8517844514c737859121308bea23fdb36ef2a2

2bd621264997b87796442ebd3cef538f513bdd760eeda865b5fa01bd0c6ae93d

2cd75ebd673f90ffd220eada6c23a7c3ba6bd65373f2ad21f04e9fe0a3330a2f

2cf6f97e357019bcde90cfeb07d664c27738ac57c71878274a68b168c1ff362c

2ddc96ce6263cb86da936ca7bffdaf14ca9fc282bf3191c773e2a2138b59a211

2ee32b86f64f031ba0ea9c0338e5a05d755afb2f92d6345cfed12869b2b229a7

2ef37e17c2d4e7bbcaf32d1a3cbdd930dee84cc69ad4b5c5b61d7e668371e471

2f6536cd2911877579d15f06a8cbb9e8a1b38b30fbba1e02f87656506ed14e44

2ff46bcd28e4741fa3ccd7168e0bfb3c726feeff9f485009a6136e8c21dc7328

316d5e87447ff9ae455f39943a3f62754ab8bf59b58ca01e536bdbc35a398cbc

316dc156b5cbc2667a692e0c4b2872e36fd40a557b56039aa1e8b78e955aa905

31a252de3cda5129ee70ad35e122d0c16f8d1588cbd800ad335e93f25852ad32

32c02dca3807ee08769be869298695c0a6f42a85567184f6041da6798cfa95fd

32e7e27ee627b7f5f2cc87646806a1dc418e658a6bad41ee120ce71d97bee711

33e3bdda78378fc3176e4366fa4307cfa08e6ec5d62a6f4b965ad2cfe98ba24b

346ab3fde761b60b51e396d9c6f73fe422f35cddc15f7df82780c4050b9dabc3

36b2ebd67e048f439bedb33e715c90f628780654e7cdcb5a0576e568fe8c39b8

3710fa3fa5f706a79b052f37f0c9e21bbd23d20fb2012be847cf250315181436

376a64bedc7e8d6765d95b93e820756ca7ef387d24aa45297b1d825d25ecaa0f

391b3c42a7a085bf8faed2d50d7d27aae15a1f02bb9d5fb2b6addd0b388b8575

393a47fc36abdb40dca0c284eb095901fb849143789761665ee2598d993bb033

39587f141a90d4946782c95e75d672932749304aa32dd7fad1d9974f2d691d63
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3a6e2cadd8d4303ef21e39dcac3d2416cac6b9f514059d8184e7bf11ee77b801

3bed8a6e4eb5e9ca916bd155906fe707ae1dc41c31c1ce7e796b480196d6a2fb

3e0169e424bc5395904bcfdf9d0f7e6f7fafc7d3d197f228fef3e974677deac0

3e9bba8ba18dbacae4c63faff36dbc2d6188c11fe2bad163988718033fce2df7

3ee695468e4afb12c30e2dc37935828e06d0866637cd572901c88a4d8c211fdb

3f0323572f48ebac6d75fd67359c580135a30d80a7693b520b9432d9146d86e8

3fc2b3fae8147f6649aed2a8719b8771778edc048599217d0cd22c5e70d0dc39

3fd8180a923869ea42540151e384cfcb163d07dedc05b1f9142a970c3dbca614

3ffe69c9e2e2f8a350f7d2ff6e64acf8cffbf390489807b81cf8e4eec87d4047

4011f7d71001982ea1c6815cbe6e747f19bbee86341d8f2807fefb50e080e84e

41cab898ef2d99eb5fe129985763228bb1d102dc66842889d1be4a1139aceb5e

431250db0267a5c5394c50bcdbcb1e34475a185c953f6c7b25489044cb83ebdd

439c8179f7f16d025a756c5e27da17a2dd1a38475bcefde51f8a391f7ec30321

43ec07a0ae1787aed9f382d6f961843c84966ef8669bc7b71c875cd9c17a7a54

441ca3aad8111e0c425948750485d274575b7fa26e00ddb23c429fd260a9c0be

447040fdadfb03b1c7883145193596975fd216db539c3079aa0a9ea9fd68a8f3

44b03e2f300a980f7d8b43a740049913a1513252602dc7de4f4024569ccbfd9f

44d79abd26345b8bbe8603be4d607f994564e7a96f6444c8799cca8316414947

451a2fd94d0ac232e8d243f9f4ddad0a1709048a58365a52240d493cb6f26990

45e7bef47288c638566e1f0906edd51f1ee1d3dc137539a291d86f983a0c954f

4676c4353bfbf014021ad1ce7a59f9a863841904a9639f064b9f5b7f0ab6ba0a

474ec542cc0db502612b2df8df7f06e5d46188cc5c25a19218596af184fddd35

48b6c7a03efb45af665a1a0c291d7ede66560a2da00c9577da19bab3ff23bd43

4aa7eb4a4e1c54d6f990cda0b1789e2bc38028e599bf97db72acc137b68a5891

4bee28337a884c4e60834323630c8c81cefc02ab4144b7d4657817aebea02365

4d0c99bef69a899989b4fd44524616986fcc5c10346f1b74cbec9e3c0c05293f

4de00d4f21465260f7d67d3fc829ba7124ab5324def519398dd98fa74f675f95

4e6f0988adc75d578451338397710b3f9e07de7b3530335db64da5f0d9b587b3

4eef76df493c9cf94149366517a6bd8bd7f4210b548c2766067f2cb00c1dce50

4f4cfecce8e006d342624d6df77527229fc19a72d62e20b83a58724e2d9309da

4f57ba579a15bd0bced0e1aa31fdcff9806c007b004e4fcb86532e69e52fd734

4f9c8e494ef8bc6f94ebeabd6bab4776db239778031e1596db370c74a3c94422

50f60b18f9b006f453512f629112286b804226c82efec01843161e7851137c00

51be858e35374462a81d6ac2255c62c7aec3eef37f5a25340d8c9602f9fa60bd

5266c8e3ade83d4aadce4277ddc59dbc68262030e4ad2dd37273c1370aef65f1

27

52c02a0f2d6ada3b0e277df6cdcdaeb9e3c232c9c1ffbfca609a316c93d017c8

539f252b37e7b1f2b94f513e91f979e026d0a0999d51e09a0624cbbfaaeae479

53e26d3ea6898d8e6d96336bc0e1ddad21843e4bdf18876522b4dd26f2fe5572

53eed8562c117904b218b2ad0976e43b499c7d70a267b377cdd887fad1d3a29d

55cb6e4d3cca245586ab253f83022aa6480373ee45c62086085515f39a26f318

55e10e3ac2342c0ac29e8a6007e51c852edfc1218c431369a5b1b0a1dd7e2253

5669950c16d76be24f5394983c2e91d22b6b1582ab1e78699ed533df6dcbc192

56ae25ec5b26379514f3cb00a72e4964b94173eb369c5f05e34fe749d6e85d2e

57a02fe0a187a210042ac518f4f55e3452f9bd1aa1680d3ab4437d7ba6c58c43

57d70632eee9752d450ba8fde366824c5e195c6624c910e272f5d30ccad3766b

581042b5b9b2b4d37dd670341f556f98791562739b4c3fe3f416e83163051e32

5863c04d10382cd956f87433d2bd68dcac68eda7c88d7f5970eac64b60b33f73

586613a2506f708c525ba505a0724217d957987cef748931a0834c36e83adc66

5958185f009aead056104cf9525882d685d5e739bea465325e21307857270b71

596eebdb10185419a2e5f5b1836b7d11e472f637f63b0612219bfddee1793d29

5a98f67175dad747f2b4d3cc79bfdfd9fe28b4f2528d1b7f4799d27f62a39231

5e2c927c0a5b6fdc9884bf1e212554942ff72437005f88611e3dc635c0a28a72

6148471c594ff12e93a4dbe51d0ea958cc590d1852426c656a47e0dc8a95ad09

6171d9d842177c2519f7d0bfc3982b341b0f6fb9de3d72f09cbb10e991114c17

61a385620023354b1ed3943c013c283e7ac8e0225090d413e1f15c6edc7b6170

6200f1e6b2c758e70b2e9f2f3166e4ed5f595081a36db3e647ed516272054ee5

627f1c4522ebd5565d288793080603b32a0cb273d30920038669b50aff38efa4

62e51d2de62215019d0c9d4a52ad1760cc18644b96797ffff90aa887d804ffe5

62f8c035666fe30325747701cbe7de11cbd2c0094c207ed9feecb76f970683b9

63df016ec0690ddabd61a6e499a6e01ff48b5d4f46e58d67b581fc22654f9005

6409677afc12251078de62c98d0671a6a1ce1f72217bcc5e084b5f84f8a6c79c

64232a4dd1719fc9c4a5c7f00adbd4529dec86e5a956e4ba82ff0aa7e15e0f01

66d77c256b453f9cefed52b35b9c82f957f0669316acdce52d24958235c4742e

66f43fbb336dc9d743759dbe147113645336e62a35ddd0e25cc506b1e11ae86e

67262c8857e4f6b68673ba61b19c5fc9b81552794c9f2768a92e675ca68abea0

673722230f682ee92d16e719f85652a34ef13664ab1341d6d49b90b904b4b455

6764adef097a27375ea4a5921e51dbd8048ff45f10c8ab85d5050433df0b6334

67b71691690e9cc56ca2e67a6889bfc1c92add9a1a7a3c499779f2492d8fe5af

69b9cce961ce3985c54074aa2c9bc7632969380998078b9c8963ec3031b1bf67

Sample domains known to have been responding to 104.18.23.52 include: 28

hxxp://bafybeifoiwykvei2k2bk5neozkm3f4gdbh6d2agg27alkqq472q64kfcvu[.]ipfs

-

[.]w3s[.]link

hxxp://bafybeiarfn4y7pqaowxql6wbkuhi5izp76feqm5oockodhtskvv4h74kne[.]

-

ipfs[.]w3s[.]link

hxxp://bafybeieq7yeiaqgp6xqpkxqg3znepunq6taakmmb4343a4wxyp4vq2nikm[.]ip fs[.]w3s[.]link

hxxp://bafybeigvjkqkq3s2sz2stcqjq5uve2o6rmiew2occt4bazz62lqbnoj7ku[.]ip fs[.]w3s[.]link hxxp://bafybeid2udy66wb3k5tvouvyh5vlkzod7jtknlwp3buk4c2rc3vb5p4rja[.]ip fs[.]w3s[.]link hxxp://bafybeicdnf6pnveieqielvgfd4dgfwb4bs3er6tdv54z3ajxiartcgtwza[.]ip fs[.]w3s[.]link hxxp://bafybeigxwyg4nnyy62gxpzkc2vker42l4zab3dxm64tqspivlqxtyxojoy[.]ip fs[.]w3s[.]link hxxp://bafybeieoehbi3bozw4rhtadsuw3wizt6or4dm4afhocd52nt2w4mwmcjsi[.]ip fs[.]w3s[.]link

hxxp://bafybeiah6u2xz7u7lgqbrcjx7dkleth7od2ruwb763scrx53uv6dyyidte[.]ip fs[.]w3s[.]link hxxp://bafybeiarotivhlx6aowgrqr7wwpnph74fsvk7ausj5amtz4lz2tgtsscf4[.]ipfs [.]w3s[.]link hxxp://bafybeigno2w5vo3wft7vaiw2emsokkdp3q4fxj6jofuoeki6pr5itmjvxy[.]ipfs [.]w3s[.]link hxxp://bafybeibgwyojlbt5hivhyxftcmdiiwd4xsx24l3zuyintzqdcqlmgtyssm[.]i pfs[.]w3s[.]link hxxp://bafybeih3semybz46v2auyau6bwbb6bmn4vnnadw4ra6pyifniuamwhebdm

-

[.]ipfs[.]w3s[.]link

hxxp://bafybeihg2js6ljraoyz5agtnqwngknvtqzgcexfaqq4ifu57s3hmve67hm[.]ip fs[.]w3s[.]link hxxp://bafybeic4y7xrpjrqp2jubl3btgyjd4vu44xp3t3v2sdyaquxt2oiamiuju[.]ip fs[.]w3s[.]link hxxp://bafybeibn67lgqdwhfpf3bl5vg7bako3e5x5bj3b5uxm3oxn3lcz7xbrrnq[.]ip fs[.]w3s[.]link hxxp://bafybeicrq3hypfwbpqhncpcubit7xrnvfncw34s22jc5u622e6zgit6t5q[.]ip fs[.]w3s[.]link hxxp://bafybeihmtlbpmza7wjzvjsomq6kaestvee2oszw2a5pimjhpxtju7p4msy[.]ip fs[.]w3s[.]link

hxxp://bafkreialqhpgku766iujjzyvkp5ti52svsidzmxh2m22volxvsqitvxjqi[.]ip fs[.]w3s[.]link hxxp://bafkreidjv4vdxf7pl5b2hctutntnapfjorzd3dfcft6t23wkbveguyndmm[.]ipfs [.]w3s[.]link hxxp://bafybeicwr6xv2jvegkulb7aelxftow6ipqqiyumcrl6yonyvrqjh6isyfa[.]ipfs [.]w3s[.]link hxxp://bafybeide2cap7dwaz7noybtd6rkj75afd2g4ktgndfhoijhm3hixlbmzlm[.]ip fs[.]w3s[.]link hxxp://bafybeibzdym2xb6sticxgaejsykxj4inc3li5dyecapdv7ursp6vilw54e[ .]ipfs[.]w3s[.]link hxxp://bafybeigpvsxliiqp4zrzsvtox7f45w3kxlihnfv7lauby3pv2pmjbtxb44[.]ip fs[.]w3s[.]link hxxp://bafybeif35ymavla27r645kib4tcgve3qlrzubbijzhq3dscrbmcihj6mya[.]ip fs[.]w3s[.]link hxxp://bafybeiggma2d77tefczrifpz5wwvhvw2wrcfko2wdk7sifdd33kmtc5zru[.]ip fs[.]w3s[.]link hxxp://bafybeia2h5v7itkdr3c3njrktfxpnucn7hjlrxtr2wegy2bawd6muumscu[.]ip fs[.]w3s[.]link hxxp://bafybeia5aj45vwoxl3ieojp2ek35c7cjbz6zqp3whlly5zhllcrjz5hqfy[.]ip fs[.]w3s[.]link hxxp://bafybeiasmsxxjzhmrgusj3tussufqz6vt63nupiv2mvffvz4ksp6yiydf4[.]ip fs[.]w3s[.]link hxxp://bafybeifo3sytrpilq7t2jshaziweqy7zyk6whzh3quta6jnjbg5v7nslae[.]ipfs [.]w3s[.]link hxxp://bafybeif5m3nfcet6xtxuiocna7pesiiepo76apkndx2vry52elx2x7px2q[.]ipfs [.]w3s[.]link 29





hxxp://bafybeiaemax6uhu6t2ujov3uzdufnbcrdzs7hdwtict4h3ucoxrb4whbey[.]ipf s[.]w3s[.]link hxxp://bafybeifv53owjok44tyv7mcge3kpehmfbdtnpfgof7heik2j7pneg7eai4[. ]ipfs[.]w3s[.]link hxxp://bafybeibew7lk2mf66wa2gi6d3ezutp336vp377c2hiilib4bdzhrji2wve[.]ip fs[.]w3s[.]link hxxp://bafybeicsrkxc6pvn2nwzd2wivjwf52n2mn52ulmwhrwndbebmlebpfrhpi[.]ip fs[.]w3s[.]link

hxxp://bafybeifrq3vagytnbl4uw7hqjvpgdn57pdksuvdg4ovtblsbqrgedk56nm[.]ip fs[.]w3s[.]link hxxp://bafybeibgivahg2moxn6qoqttk2fbkcuvmjhmxxi3bz4tngcjqiyrr2z4vi[.]ip fs[.]w3s[.]link hxxp://bafybeiftny55ajmwwwzmmyxxjld2aowz663iza5ti3raxukknv7bqqnk4q[.]ip fs[.]w3s[.]link

hxxp://bafybeigbpv4lfshncbqlgvnupht3h6tkcmrermyu7ctvfzoqcu62oshq7a[.]ip fs[.]w3s[.]link hxxp://bafybeiaix7ewvyraltg67j2puatq4xllzvoch3phd3hop32rtwn2jn4dcu[.]ipfs [.]w3s[.]link hxxp://bafybeigsx3nzfrocrgg5sryqwb3rcfw7g3oorzug3elm3zk7hjpkablpse[.]ipfs [.]w3s[.]link hxxp://bafybeifzbqdck3anxdc52kqt3cztk2fwwmls2y574jd22moifmfsvpcxae[.]ipfs [.]w3s[.]link hxxp://bafybeidit3mup6cs2j6zr3ggs6rqjwwcmm7uahw4izkopn7fihkrdczr7a[.] ipfs[.]w3s[.]link hxxp://bafybeie2bfzupd7ak53xz4imo4lytra5dlr74zyshuapokjwlvkltqle5e[.]ip fs[.]w3s[.]link hxxp://bafybeihlwm5wosfdfep67kpxsposkmfy2pg4ty2y6ovgyqeblc5mtq5rsy[.]ip fs[.]w3s[.]link

hxxp://bafybeigqbqkmlulrauaxjq5mw2sjvml6ysjmsvgkourxm6t7gncqiejnum[.]ip fs[.]w3s[.]link hxxp://bafybeifukg3y6ktng4u3bhwtigo7w7kgy52lbhsrtb2kgyxzc5ihzr22bq[.]ip fs[.]w3s[.]link hxxp://bafybeigpjhe4o44q4cycljov3zzkdl2ryjvv57lmr5pvekgtjye7budrxi[.]ip fs[.]w3s[.]link hxxp://bafybeicqu6eclqdjlu6h6q45voumkz6oef5qbgsakuymiaovt2ft6qtzie[.]ip fs[.]w3s[.]link hxxp://bafybeibucwomwhuava46rcskf7vp56lb2eekoqbg636t3nkfmizzysgrye[.]ip fs[.]w3s[.]-

link

Stay tuned!

1. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhDGibwdUZ0umTIehlPnlfRoE0nb16QQbo_q8MnCT37ys0Zn

drHe380-6J6wTplGioxiGC-_YHjAbSMr_-0Vdt09DFzFY6cQ_ooMe9

2. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhc3ih1Nj2WUSpMG-XhmdmHuHp1jUePdVSGh6YN_o2W5WJ_d

KjFIv_JBYeP4t8wvOE0sRseKg_HQvBjvPeDGD0Xw1aXjDDCMudZeQ6

3. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjN5K7dWhJjRnswgT_9WC8RUXF1GrYdTbptzs09ygN3LF5Kk

R1RTShq7bYxdFadfh7t17oF_bw3N8SObZLsq21lxtR1yX8l8UzgA7h

1.1.3 Dancho Danchev’s Blog and Twitter Account Ebook Formats - 2019 - 2023 Research Compilations Available (2023-03-07 23:55)

[1]

30





Hot off the press.

- [2]Dancho Danchev’s Blog Official Ebook Compilation Archive - 2019 - 2023

- [3]Dancho Danchev’s Twitter Ebook Archive - 2017 - 2023

Full portfolio of research circa 2005-2023 in various Ebook formats available [4]here for free.

Enjoy!

1. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgRuo44Fgd3ivMij9tkp77iTJKvVGQAls0feqgA0NhJat44p

84qFR8IYdTzDrLKXY9VgGUryZIf4IsSzVNQDBwwe4m0istwO8RY1lq

2. https://archive.org/details/dancho-danchev-blog-ebook-2019-2023-02

3. https://archive.org/details/dancho-danchev-twitter-ebook-archive-02

4. https://archive.org/details/@ddanchev
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1.1.4 Cybercriminals Offer Apple Themed Discounted Products For Sale On Major Cybercrime Friendly Forum Community – An Analysis (2023-03-18 07:15)

[1]

I’ve recently came across to a currently active underground marketplace forum proposition that’s basically offering and selling Apple themed products which appear to have been obtained and purchased using fraudulent means. The seller also appears to be using several techniques to actually safely ship the products basically everywhere and is using another service to guarantee the payment and delivery of the products.
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Sample screenshots include:

[2]

[3]
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[4]
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[5]
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[6]
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[7]
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Sample underground forum proposition:

" The product is only original, packed, new! Absolutely the same as in the store, only cheaper!

— Apple products are a priority and are always available at the drop, the prices for it are fixed and are indicated in the price list below. — We send it anywhere. — In order to protect ourselves and you, we will work only through the guarantor such as forum escrow “We can overpower any volume.” — The goods pass the customs control without problems, sending on the left waybills. — Sending goes from my drop, take on SAFE, there is no risk! — When ordering from $1000, a nice bonus in the form of an additional device! — I always give the track number! (number to track the parcel via the Internet) — All GSM devices, neverlocked, will work with all telecom operators! *Dear Clients! Read carefully all that is written below, here all the conditions and nuances [Payment] — The minimum order is from $180. — We work only through the guarantor escrow of the forum! — Write to the Forum guarantor the application as indicated in its topic. — After you deposit funds to the guarantor, immediately write to me, we will process your order. After sending, I give the track number. — Major transactions in priority, we process them faster and more efficiently. [Delivery] — Delivery by mail DHL or Fedex (we can consider other companies), anywhere in the world, no longer than 15 days. Usually 7

days. — The delivery is included in the price of the goods! — Before we write, please read the topic, you will find answers to many questions. — If you do not answer immediately – do not panic. we receive high volume of emails and orders. — Subject for feedback, all questions in the PM! Recently, unscrupulous schoolgirls are thrown on different shit forums and social networks, impersonating Serbs, therefore, when uploading photos to the forum, watermarks are automatically applied. Operating since September 2011. Building a good reputation is one of my values – I will always do my best to surprise and stay reputable. All iPhones are sent 38





undamaged in their original packages. It takes 2-4 business days for the products to reach any location within Europe or North America and up to 6 days elsewhere in the World. All of the iPhones come in stealth packaging, declared as items of lesser value. You don’t have to worry about customs taxes as it will already be PAID for by us. Trusted. Safe. 100 % Satisfaction guaranteed. “

Stay tuned!

1. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhbvH0FCqznIn4VX-W4LIi412UU_Awt7OueSohyuJ8TNe2Tj

X44rA6QK9l40rxJjyIVcChudf4X4nF1A7Wzs0XB3kKBuzQGl98bz6b

2. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjkhB4lTXCZbQMXusZdr2HSgWMEDOF6oS4i3xekSvkIL6j7X

izbmY4C30-JsnOsDbsl-2udJOmCvoftqDwk9QTswusdy6LjA5C5W73

3. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEixcJS7qMkBIOte_7zHfAJXxgtCx5kvtufP6fD1YGydq9CCq

QxRBEudl_dMZ6p-egmcL7SiWXtva927EwWhYwd06_axNDvhHO5dj28

4. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi7iJtaLcILNGRCMQ9lsjJ3WpfT3ejXp13S17vviTdst-Mn8

1K_P6exQ3IxEoOnlDbTUq1r9RN5R9R4_cNoCnk0D2RZDGj6C8W6HC1

5. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiZcnhPCuzK2omTePtduVWTlC4e4gItrUe6jWqg3amxFBocJ

4iC_gbRQAPrtMqjUwtEspSzgVlci2bBgxBOb0oAjT98iw4fuFZlOv9

6. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg23rWxPJD8MlN0p30FH1db7gBmdwmldztd34m4D8cOSEOru

ye24YDo0EvhD9dH5g8RGf0JeLhI2UE2V6iTo2Y-r1GdXbR_Wmar4Rq

7. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiBA7UY1BAJPQQSO_XJuLvSc6M-21Z0XdpNYsHx1qRngzv44

8q55YH4YuDlCEVQWWmFbfY2llsXUVboeJXmU0ySmorzD5Q8abF0o6J

1.1.5 Profiling a New Vendor of ATM Skimming Devices and Stolen Credit Cards Information On A Major Cybercrime-Friendly Forum Community – An Analysis (2023-03-18 07:19)

[1]
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I’ve recently came across to a currently active underground marketplace forum proposition that’s basically offering and selling ATM skimming devices and stolen credit cards information where the seller of the devices and the information is basically offering a variety of screenshots to demonstrate the existence of the service.
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Sample screenshots include:

[2]

[3]
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Sample underground marketplace forum proposition:

“USD/BTC Mid-Balance Clone Card (Price: $260) High-Balance Clone Card (Price: $400) Super-High Balance Clone Card (Price: $875) Card Balance $1,300 (Min) — $2,500 (Max) $2,500 (Min)

— $4,000 (Max) $5,000 (Min) — $8000 (+) ATM Withdrawal Limitation $1,000/day (2 Sessions of $500) $1,000 — $1,500/day (2-3 Sessions of $500) $3,000 — $4,500/day (6-9 Sessions of $500) Banks Chase, Charles Schwab, Capital One, & PNC Suntrust, Citi, Wells Fargo, BB &T, & PNC Goldman Sachs & Private Personal Banking Card Type Debit Card, Bank Issured (VISA & Mastercard) Debit Card, Bank Issured (VISA & Mastercard) Debit Card, Bank Issured (VISA & Mastercard) PIN Four Digit Pin, Overlay Pin Transmitted (Multi) Four Digit Pin, Collected from Overlay POS/ATM Four Digit Pin, Collected from Overlay POS/ATM Data Acquisition In-House Skimmers & Skimming Network In-House Skimmers & Skimming Network Skimming Network, Subordinate, & Private Sale“.

Stay tuned!

1. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEijIMDwu_HXvxAa9zEgZMgKCgZMw1hBG19K8yM5dtB2in90f

Xuc00ODKiI7ImkK4axfgTBjuiBFVxqiKbGUAPIAQE24HNhJ-mhLTTY

2. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgx87QpyC5VgN78Ph71EnIJbXWOwl2PeWAQYlPLbcTXenWWk

ZKR90xA3wafTEBsffX2_YhVYtQReYZ5vXehg3IylbxYeLBLgK8cArp
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3. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiN3Bsv7x9FrutMXjwSQjq8_TpqHxiLulimSsTGDQHL7GXLf

hCa2R0zw0ZQ3jT7qvSouSgI4-uiKW91NOxxgqyBtsKLsMpxCN7OHgz

1.1.6 Profiling a Currently Active Vendor of Western Union and Banking Logs Including Stolen Credit Cards Transfer Details – An Analysis (2023-03-18 12:18)

[1]

I’ve recently came across to a currently active underground marketplace forum proposition that’s basically offering and selling Western Union and banking logs including stolen credit cards information where the seller of the information is basically offering a variety of screenshots to demonstrate the existence of the service.
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Sample screenshots include:

[2]
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[3]

[4]

[5]
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[6]
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[7]
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Sample underground forum marketplace proposition:

“My team specializes in stealing financial data such as credit cards, bank logs and other financial instruments from hacked databases such as e-commerce websites and spam for card data using email skimming/phishing, SMS and website fake login pages to extract card and bank information from victims. We use this data to transfer funds to you using western union, MoneyGram, bank transfers and cash app, etc. We use westernunion.com and moneygram.com to place an order to your pickup info and order using the victim’s cc data. We can also do bank transfers (wire) to any bank globally as we have data from all countries in our logs. This is fraud and illegal, so anyone wishing to use this service should take precautionary steps or contact me for essential advice if you’re looking to get some easy money. I recommend doing these transfers only once per account/name as it gives a higher percentage that your accounts won’t be locked afterwards or, ideally, use fake IDs/drop accounts. We sell on multiple dark net tor marketplaces. You may find us on other marketplaces. “

Stay tuned!

1. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgCYAdwy8rP3aVUeN4J2shXbAQuMNpAN4Ec3q53UYHK1M5Xv

hFYY9Z7MVHgiRloUkaltP5Q4a1Xckf99xVBnNhfLIFMCkdZjroqxLa

2. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhBSZjyEyeA9vmce33_CjEKQEBQNIrrMra9RgKDPoIDNRIaR

lmJc5rSBkMVLC9dbLphq1Wyd2QkbiYaAetwoysGan6TZImMzFGN6FK

3. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiL3gWufw_sUqK83H3ZbrzIKhD1bMpkIXo9eW0xNAhJuM2Xq

QaJW7167PYsNO0SzLPj4zEpq-PWufzz5LknglJ1DQMmb97Yz3tvjs9

4. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhU__060qSqqpdbwKlvYo4tADItEOmrMOxGvDaCObWbWPQ7z

Wjy30eTpNHpKus2pqjIUgfu6LqnytmCNNK_2SxlLwSaLRkiikfF47i
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5. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjhRD2CMxaSGzme62lYspXZNT9EBt55CTZ3dQyRZqYESJTc1

kwUJx4KpAaAHuf-D-DNs-N9YfgVZWRbjGMZpeGSjqJQ_0s69sdvCnv

6. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjPFMjtTG4jC_FuOkh_XPcVogBbzxEgwZwpf5_28ESv7thCp

J9_1uPmIsjavVWPJ1U6-CDfrZ9CL_qHDeGM924aqlQfOUHyCZZHscd

7. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjpeK7TbhSuPMgTbMzy8JlwXAI_xpBz_NhA9m5lwhzVbY3nF

-mak8Fwil14fhQkUoydiuMLMjcDJ2PC-kCgrjZZN3cPDMgAQ2wYaH5

1.1.7 Profiling a Newly Launched E-Shop For Fake IDs/Documents and Certificates –

An Analysis (2023-03-18 12:22)

[1]

I’ve recently came across to a newly launched E-Shop for fake IDs including personal documents and certificates which offers a variety of some pretty informative infographics on the topic of how to obtain and actually purchase a new identity based on a variety of countries.

Sample photos include:

[2]
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[3]

[4]
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Sample underground forum market proposition:

“Identity card / social security card – A passport will only provide an opportunity to enter the country, but in order to be considered a fully functioning member of society, documentary evidence that the person is a resident (or citizen) will be required. Each country has its own specific forms of identification, but all use a driver’s license as their primary ID card. Therefore, both documents are necessary for those wishing to obtain a new identity. “Birth certificate –

This document is necessary to substantiate your citizenship by birth: to be able to prove the fact of birth in this country and that the name, date and place of birth correspond to the new identity. As is the case with real citizens, this is an important document when purchasing various government services.“ “Education and qualification documents. The key element of the new personality is the person’s fake general and professional education. These documents help start a new life – create a completely new backstory with which you can already get a job and find a community. Among the documents about education, we make diplomas of secondary education, bachelor’s and master’s degrees.“ “Financial documents and services. Creating a new financial profile is another step towards creating a new personality. Anyone can update 56





their financial status with new bank accounts, payment cards, credit scores, and even new PayPal accounts. All of these solutions, again, come from a wide variety of sources. Some bank accounts have been stolen, others are legitimate.“ “Estimated cost of a new personality by country: USA The cost of the minimum package is $ 3150. “

Stay tuned!

1. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhlXvLmGHBMzD-LYpIJJrwz_laAccHaIwYPXH4kOQ48M1Kj2

Q-Yl2gYS7g-BSf0h-qORD9rEcVzl7ND3i4Nrt1tR5DJvwwGBOqXTLA

2. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhFgLsxKMS22BMx4MwXt9M-4KgSPr4QTbVhTboo5BBlg_td8

UOtTPbMLMjRloonZH7EpXxgUmZMGP-gXw1SK_5FJA__Sr1YkmFiNlZ

3. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiuNZ_VZU0uWXyPa2Kcci-8FnU9-lWtHdSww4qs1PNwNItwr

FMQ-mLjYuuLr_MeQyoUaLhKTZs_z2U2vGitXFF2TYPegReb0R5KpGq

4. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhp5jZzzzzuESVC8gZaJMYfiztigOY2rybugrkPuJr5Eu9V-

kam937dqR8egTolX3mZ7hjzqJHr5FonCxeBkEqRjNWxe4rYId94p0q

5. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiSlObwXl2Jvajv9-ApGxj-EToCxYMQKXopu4zY5xJdKytHV

cwl4VNZ_KIMtbLyL5fjKOoJ-OQqgXSeklwUHQBoQrckcSmhDwXVwrn

6. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg7mQwyh5N1gflYCKxutFEL4RIf2F6--RKUtH1hYGv_RLLaE

4LfSjrMJG9ZMzECSqFqRVVNrG6YjTUNJFAhs0aYNpln18B1chYWmQ4

7. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjrk7gtC97FMmEhN0eKeAANclLidJ3DPzuCVOo5nLax394ho

aVzdDzf3evFquJxVfCuUI3nhbh3hA-VN0TqdyqWoYz2FRxVOZB1x-Z

8. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgD81ftPnBzsmFnwDXtjhDinQ1S1kK57ZrFJPhnNSPoKAMcd

K_9YGH3JWO_P5N_eqDo703XdtwR9B1lKqfiXpL54LDx2QSwlV1Lu-0

9. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh5ugwCSFg1Vg8pkBysz_uQJoqJIdi8lF3-S03Z2gG9gNY6b

8ABHIAHzo7UUshMlrKyjwv7G9ZbGiBl2qWv556rOMEwB2PvlUAGybx

1.1.8 Profiling a Newly Launched E-Shop For Stolen Credit Cards Information – An Analysis (2023-03-18 12:34)

[1]

I’ve recently came across to a currently active E-Shop for stolen credit cards information that’s currently syndicating and offering access to a multitude of stolen credit card details courtesy of various underground marketplace vendors of stolen credit cards information and is currently 57





offering a pretty interesting and massive portfolio of stolen credit cards information which everyone can basically purchase.

Sample screenshots include:

[2]

[3]

[4]
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[5]

[6]

Stay tuned!
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1. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiDlNaIIzTxCT8CkZcJrrdluTqyF-vz5aEuHT4FnkG9XBAHT

jCzsMcYN8LDwSNvo2rC483FtDn4ajNM0boIk6HK_0Td5EbhdcaYjw_

2. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjdwfR_nK_WQ7fITth34BeJNvjnyBQ6CUKlTLLXJKSbU0vP1

VaMJOnOdIjPwd6Ir4bFFAuZ-ajG6dPFVme9D1ih4awblVStP6QPave

3. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj31c8UAsOtDxIEhbtKBxlaUk3mPfSzNvhAQReVEX661bpz6

5Q9vy9oncXZcmu9JB1OhB13s6DH81pLlvHYug0Xx9D4oMZ65hS8spF

4. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgtg89IGvoak3Jnlw3wZtyBoLNLVEMV1H_kaq6EbLI7eevTu

BYKLWKEN4vK__SMJfnpxxMxXV8epAbDEToPxfwPJsV5o_E5OwZJIHx

5. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgDnEKc01hRLIBNbtPY3DDuxLeffqnYwENvpDGSTgnXRr8zj

4x3umIo2QyHYoqnu3whTsX-JSk1ArypsCHrRiSFii68G2zzkiD4c73

6. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEixtC-MDO6s_X71nj69ikzdDMnwkZYLinbVc6-nmG-Zrvhw2

hgbbgye3ErghCC0e1vbLkPu3o1qW03jHKOmJZO9DQir5T0tWKzmgSI

1.1.9 Profiling a Newly Launched E-Shop For Stolen Credit Cards Information – Part Two – An Analysis (2023-03-18 12:37)

[1]

I’ve recently came across to a currently active E-Shop for stolen credit cards information that’s currently syndicating and offering access to a multitude of stolen credit card details courtesy of various underground marketplace vendors of stolen credit cards information and is currently offering a pretty interesting and massive portfolio of stolen credit cards information which everyone can basically purchase.

Sample screenshots include:

[2]
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[3]

[4]

[5]
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Stay tuned!

1. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiP2ksSj23JD8PPZQB2QYRePXQUNj5YHkx0IfLyo4-SDUp4k

i_X4PqT_s-5DpOetP73JRcP6eOqRH4RjMxkhEXiJfyAjO58A0ovIgb

2. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjo1-G1vi4875_E4liLLncW6yD7rUkuRwWiy5GEIUiRPayYx

dEmh2CVB4dtiToa6xt0pA1BW4IwKXId-TGLFCJxw0WgPuzUC6mcEim

3. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgosZuDepl7sMvSWxvLUzwxdNDNaDz4yLpoVR3w9p3fIkRVL

f_GTSly2Z8bS7TBT2kchQDfbgyuiWNKtlY0lWBiVzS6q9ekF5II9px

4. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhNvh-fV08Q0SJbKLIkTF7VOJ7x-oBwu_DTV-VqEbkVsAvZ3

9V2C47tIXAofUwmzn6dtdpr1m9DZ8DIHKodq_LNI8hEpW4hcdA6dgB

5. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgyBefTdGF5Py4XYlVXPRc_P_P7-wf1zwH1y4A_l9TliWufQ

ANd-zy5CJdNu9P4y-zqFloIlDPiPSETOWabYT1BYvwATQggVsxqJWw

1.1.10 Profiling a Newly Launched E-Shop For Stolen Credit Cards Information – Part Three – An Analysis (2023-03-18 12:44)

[1]

62



I’ve recently came across to a currently active E-Shop for stolen credit cards information that’s currently syndicating and offering access to a multitude of stolen credit card details courtesy of various underground marketplace vendors of stolen credit cards information and is currently offering a pretty interesting and massive portfolio of stolen credit cards information which everyone can basically purchase.

Sample screenshots include:

[2]
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[5]
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[7]
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[9]

Stay tuned!

1. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi5cxR__xut8Nb-hVgKLHglGiaVqJxyZzIyZnk8WUw392ov7

3U3RwX1F3ApT5jaglmrZbRd2MMaMntQmvTxMQXAF0YSg0ppcNcJCms

2. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgq3P5h5AUyASdd-2N1E1QcJJXvG0SecESNqZqNc1kXHBLJn

WxcM5KE_LxpN59TBAfXXlnvb0_xya5RFrGJCVWbUSmE0t5gpsf2wR1

3. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgLRQWt3C7nnUNh2o1ZFY9AYyHaa_dsetqm2DbvKUZS1vOJ-

jKFLmUbAkSZtkDlSey1GMklONC55UgbeJKGbCSR1HMuteN26CTAWEq

4. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh_8tlAxVDXUVRZDDzbsxmNKNcvLR3a6BI9RwOCoZytEWfbo

hriSRuGg_wl6qFMrcMIevMDydMYu4wcgXEa9UN85trJbbhrs-j4cjd
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5. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgNYfKFIodJgJHljhp1yiunEuXcc-zlBJITyAGZOZ56BOHnd

pxg3M-fZCjzEhi9rXXtvkmh1RfIDf9hGQ0LbUp5buG9D95p0omg3io

6. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh0kbf1Z5OH3wnf34KfpcSKukPc4NBjYe-XemOQRc9Wd_vKz

lJszLX2uX0mF2sagdgcRvTvXbG4RKDS1uS81u86JXpfXoYlQ5lBe1K

7. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgomY58MHFEhFX0bMvPVm44yO6zHTtup7E8osMUG8voadofl

1U8OJ3Ge_uAq0vtapQwqClTHVBCo6p3SAdudIY2sBLojAvT9QsVmL2

8. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEikLY9Fd8gqW4hMYXD2VD4_9npAqpyrwJSYSR28e3MfLGf9a

2EUcQFHq3bYHiiGayaE-M4nxty-a3f_wj_h-9DcCY__j6nzdhrqSZD

9. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgLWHQnEq0KtKzwndjVKYkPu6Cl7-LXczk8DhoVA4taAviVE

LKEplug7Kh44yRBpngmQQ0kcF61woK40rCr2Z2RtX6kEW55j9SMCLj

1.1.11 Who Wants to Fuel Independent and High Quality OSINT/Cybercrime and Threat Intelligence Research? Accepting BitCoin Donations (2023-03-18 22:57)

[1]
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Dear blog readers,

Did you already grab a copy of my 2019-2023 "[2]Dancho Danchev’s Blog - Mind Streams of Information Security Knowledge" Ebook which is 1.7GB compilation for free? Did you already grab a copy of my [3]Twitter 2017-2023 Ebook compilation for free? Did you already grab a copy of all of my WhoisXML API white papers which I produced during the past year and a half [4]here? Have you also downloaded my Cybercrime Forum Data Set for 2022 including a free 256GB compilation of all of my publicly accessible research from 2005 up to 2023 for free in the form of a [5]torrent? Have you also grabbed a copy of all of my publicly accessible research from 2005 up to 2023 from [6]here for free? Did you also grab a copy of my memoir from [7]here including a version in Bulgarian from [8]here? Did you also grab a copy of my 230

pages cyber threat actors compilation from [9]here? Did you also grab a copy of my Maltego training videos from [10]here? Did you also grab a copy of my latest video presentation at Cyber Security Talks Bulgaria from [11]here?

After a bit of thinking and personal decision making I’ve decided to begin soliciting free Bitcoin donations using address - 15Zvie1j8CjSR52doVSZSjctCDSx3pDjKZ where every amount donated will go for me which I’ll use to pay my bills including to maintain a decent living in the form of taking care of my family and folks in terms of expenses and most importantly fuel growth in the form of my research in the form of securing a decent revenue stream that will be a personal privilege in the form of receiving it as a donation to keep my research keep and running on a daily basis as I’ve done so as of December, 2005 up to present day in March, 2023.

Here’s what you can do in order to help me fuel growth into my research on a daily basis and help me pay the bills and assist me family with bills and expenses including to maintain a decent living in the form of being a noteworthy and a bit popular security researcher:

• Donate

using

my

permanent

Bitcoin

donation

address

which

is

-

15Zvie1j8CjSR52doVSZSjctCDSx3pDjKZ

• Do it as long as you feel like doing it including as many times and whenever you feel like doing it as it really help me a lot in terms of paying my bills and assisting my family with bills and expenses

[12]

Sample photos include:

[13]
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[35]

It would be really an honor and a privilege to get my first and continuous Bitcoin donation revenue stream up and running as of today and it would really help me a lot to pay the bills and assist my family with bills and expenses.

Stay tuned!

1. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjeoGgC-XXwBaGkqrhfBS5Mg4UZbLUsXIsr-luqUckLew5zt

SGsM8kiYNao9yA5H2dYvXwfoHFu0UbY7Yu_6IPyxikF5ZenvKp1UmM

2. https://archive.org/details/dancho-danchev-blog-ebook-2019-2023-02

3. https://archive.org/details/dancho-danchev-twitter-ebook-archive-02

4. https://archive.org/details/dancho-danchev-whois-xml-api-maltego-bulletproof-infrastructure-2

5. https://drive.google.com/file/d/1AeL46Ll50xZTwx4MiLZTgb2CTnP0f8fz/view?usp=sharing

6. https://archive.org/details/@ddanchev

7. https://archive.org/details/cyber-intelligence_20210817

8. https://archive.org/details/dancho-danchev-kiber-razuznavane-audio-kniga-01-memoar
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9. https://archive.org/details/dancho-danchev-cyber-threat-actors-analysis-2021-2

10. https://archive.org/details/dancho-danchev-training-video-01

11. https://archive.org/details/dancho-danchev-cyber-security-talks-bulgaria-2022-video-presentation-01

12. bitcoin:15Zvie1j8CjSR52doVSZSjctCDSx3pDjKZ?message=Dancho%20Danchev%27s%20Blog

13.

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjHjuu7yOipN_o6VN9EyCnz5kckS-OZjaUmFmyBRVyr61O

55irUI0ARZwC1JmHYvUq1X6-8nm7hbeTMLuLT3HNeKqolg_t_2KNqBbQ

14.

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEib94aehsVBCpX6ND1xmwpKn7x0vwzyH5U_vYTFWh1a957

-nL_QwesjPuylqNW8Ne_PJEdO65Ch0wmt8vlRSGNHkMiXNk6leZoC8-7

15.

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEidcJZVapJn1WjwcvZJUvhMIGqW5YSdqcRM7EB3SdAYBwt

X29h9Uequ-grfiHGDkEOcAYqN8x7rr7-YczbrXXhZdl_w58SrenwxKVJ

16.

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi_6Pen6qFQznhTQl84V2REAfk-afE_sKNLDKCS7OdFbly

aR56G95Rf-lGF2LpJA8uiNkeaCRwnKld_pQn3X3OxAnU4gZYftah-e0b

17.

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhD1xwGHUMDAXUvYOaPq8H8osFdHhaZc5NdUfrij8z8x1-

yC10zeEIPD17e8EnUb7NTncXdQhtEQBpc-9XeC9tUrK1WtgOeF4O-GK4

18.

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhsSzoiH3Gaoo0AZy1LANigB1bMikMhHg9eTXVZTvSM77w

rNja7cZPjEwrrbwkHNohIr9y1DXrzw5gbglVo9ptWDeLK0RGo7FazBi3

19.

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEheQAQ0iN5ncmnfvMXp_1aU4snEDi1UmYJ-hW_U8LIWuCF

jaA2BnYSS-78RKQykGmXbuSvWOMogtL6qtVsSUfr9V6yDbUjrylE0MI1

20. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjqRMm9adBtQyllw-m3e3Md-knqhVmJ_5-mcibgSNPTMtF

YHNoj2YkPhi6CpnTAKRsU2oMviCLP_WU_vQ-66xWCTPEcs8mBWSYItTa

21. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjSovWm9F1tW2wCvseHv-fpz5bTmUYOfTv-GdrMhyQZ06B

G4E_7ScPtGLvjdqfWu7BsMwjU7VAW-3u0kJPlS4hyliEAbFtGw_m-DFj

22.

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg5lYiJVvlkcAatPp61abNmD3-3U8kl6mdN9M0gYuTUDU-

RUPlwA5ku61Sr6BpHYG-b6vmpPNe9ehZ-4rhvPTqT4XGC-Q5sypJBCPa

23. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjlvvrcrz2HMT2e0PaxOvwWPdeczy_dTBt-vNbwCWdiTYN

gJC8rQ1TaYEpf6n7lOktjA9gpQ0UWuJ9hQOIm1IQCnSk2FZU3uOW074_

24.

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgjacuXLgB_EHFCHaljnTnfXBmILSNb4c97HVAINS3By7T

ie7hxnkaFgobK7eGOdp1e-UOF1AR4zIGW2-DQtuKAGGiPCqJdq8S1hWT
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XqdJyGcfAXdtvyPEWWGorAi2DNog20s4Cg98aE7yrNT09SfwXbB3CyY_

26.

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgzdB0VirmGdT9xUMjq0yFTZ4Vz7R2BSRNKSFmuDq0ILSN

bd8j5qTxu995m7AzOlTK3i5-gxsrMT-I9x4kGL870zJdV5SnB8kLM2kL

27. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiwdgxZNP3lnDjEnzdtoaZt1rnjzFQqNBUMAj7-05Qp-sL

EDCjWUwMNMKpB22KPsxpEvJ-V3NMVzbyc_AvA8MSxLFw5Tsv4TtoXeuS

28.

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhUdAwD7Nd_EEzLaNlf_6WPK8RIbvIoBqTbKwANZgsGkE2

VzLKdkMGBjvVG-J3RNd1tXAOSanNPqQ8d43Q0-h149PPBaoH6IqZqqdZ

29.

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjZXjp7PmElMhbYZgboJYP6pTYrCuSv3pl014HKuDekVTj

d4VWu298dSGYd0tc_ONdOiahj49L6hUQt-AqpVPOtp2Sv_kbLkyqyIW8

30. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjEGx9U54egkxsS1-9IzAEXWOWXIhcGA-sCTWb8Su8GAeS

gB5Gead03D_0E9DDUkHdQCTH7Gr3GsXGMtWTG5LNfROt_3PMQwjC39Pc

31. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiWEa2BBhyeYCkXNI-dEHD90_geVlfWRN-Mw7ofsnjbGNL

yWObZNNcdFZeCnv-3HHwKPhQIIoCBBKUutzx1yZq-B_wb2WGRS_vR0NA

32. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjWactLnykV19q0WVNyh77Z-PuuitBm-pj-Lcvz9iSR3N5

1NKITy-bEAIqwmlelHyTBe0k_TC7aOTsE5YCjDILegxQMEKeUiyaI82m

33.

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhhieREDpnhcmo5XUpMRMlj6kauzUv3HRYbxKhtQ8FDrxo
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34.
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35.

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhro4KxLfKyqgyLQwgmkOzSm6sEqE9ooVvDJRwgvIHCfKO

ujESj5QiGlIS0idIhrCK1Qmyo9K_-9ZdFWFC0AQ0JArY8u0ih2pvsJeR
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1.1.12 Profiling a New Vendor of ATM Skimming Devices and Stolen Credit Cards Information On A Major Cybercrime-Friendly Forum Community – Part Two –

An Analysis (2023-03-19 12:05)

[1]

I’ve recently came across to a currently active underground marketplace forum proposition that’s basically offering and selling ATM skimming devices and stolen credit cards information where the seller of the devices and the information is basically offering a variety of screenshots to demonstrate the existence of the service.

Sample screenshots include:

[2]
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[6]
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[7]

Stay tuned!

1. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh0EI_BrkZFzH4ZZrI7yHbIzCx3C0wcZbPgiP1136Zpy2TqM

mlaZAl3eYMP8yLuJ2XGKvBHvfc74JoWLsOjuoNOwFkyMSM2swDF4ln

2. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgoBwJ1nd8TgN783JKKR6zjyIT1rO9YVbZ0p0tm_xb66f3sv

D1FoQ8_RTxuvcMo6VID3YLRC-g1JNavUxnV8oLv_IZ5TlRGv9Kttx8

3. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgOJHt7_VViwhZM7tfS869l3RM8jqKArs7_Kaqq4KKBN9X1l

b0-HLgczWCOpz4RzjNeMZs1n9WaqwhDKwEMO5LYnDKGUsSbTc12-M5

4. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiCOmrYx2VtFuAv-lwcBCu4X9XbaQpsW3uEz_4nMX2v4pOEo

wjtN8BBZ6WXi6CFUQIGznwtuvEaqq7R1Ljy3sBJ-S2-AxN62CadUIx

5. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhalpdx0gjM4gnTAXHaeS0Kkhh93kOv3ioIDm5J8G1WM6P5h

qptLlPKA-yu4bJjKpx5xibBiy5zWH0lwo0mV0m7_G5bmLVj_B_nmtk

6. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg0KcezhAqd1Bx_F-m_gJfgc8qveoABo_JPIkLM2VsmlTVf6

eGUwL2kc1z_jujDipEuzQIxH_VVuhuaGbZhl08ZZgTNnk6Tu_8-e8B

7. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEidtGzxHcAlIPeebO0o4HhT1GR9blLCCo4wM8qhAoqplpI35

r0EbV4fFDBlgl7U1pEAsTkG10HBfXF6bJsH6mVXFmOLwtknigLNS01
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1.1.13 The OPSEC Infrastructure of the Infamous LATAM Astaroth Banking Trojan -

An OSINT Analysis (2023-03-24 20:51)

[1]

Here’s how to take it offline.

• Grab any public OSINT list and process all the domains in terms of looking for personally identifiable information

• Figure

out

what’s

the

personally

identifiable

information

which

is

this

case

is

basically

a

Tutanota

(vicknet@tutanota.com)

and

a

Protonmail

(bestchoice-

firstchoice@protonmail.com) email address account

• A screenshot is worth a thousand words

• Publish and disseminate all the IoCs in a easy to distribute and work on form

• Approach the domain registrant’s hosting provider the let them know the good news

[2]
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So, what’s the news? Already done.

1. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiiZt-xLYQNjxus6mcumvldp0cxX1KkejW-QNIqxpd-a4CUu

FHuLl17cjK7f0gTY8Yy43eyvb4YtniOYOrISPlRgXdjQZM9aFBCisx

2. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiv0hz3AFeFu-GAWatog1YsdN9tukNq8KHxTfZ580khvX2wX

fatZtIPa_oTqfSZ5zkwiFScLbnvvc_u6w2kEQ62dj3uD71plQCoCBQ

1.1.14 Upcoming Bulgaria 24 TV Show "Cyber Wars" Participation (2023-03-31 10:52)

[1]

Dear blog readers,

417



Great news. It appears that I’ll be participating in the upcoming TV show "Cyber Wars" on Bulgaria 24 channel with an interview.

I wanted to say big thanks to the filming crew and the host for the invitation and the questions and I hope that we’ll soon meet again for yet another interview and a conversation.

[2]

[3]

418



[4]
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You can watch it [5]here.

Enjoy!

1. https://blogger.googleusercontent.com/img/a/AVvXsEivbz8tBhBT3KAQGbyZgCX2CpMB65GkATU-z-n3h8at_kDhzIHhmVq7ZC

TEAvgZQqQU43WnPXrimXLD2JMmUjJCLTOkjohmdbTWH2_AWdm2fGRA

2.

https://blogger.googleusercontent.com/img/a/AVvXsEgr-IwMf0yJJ-rcVg3yPP-xgTWFQceteNw1ob-5Xo5x7G9AOn67rxRR

99luRsOX3P1rKcKPPN50IyJSyWjGLIuzGlgd-jXdjFXBsHfEl0HkOKg2

3. https://blogger.googleusercontent.com/img/a/AVvXsEiyotfyuuq8YVKcI77K2Hnm-AX-uY0gCCu0J9cLliTX98ktAk2dO8Ol0C

i6IYO7Oceiqje-AA1kJSkREFKHT9yAy7XYOvz5_6JmrJM9aZ4Ty9s9

4. https://blogger.googleusercontent.com/img/a/AVvXsEgmZZy98NLsg05VbkDgX2HZcvJTUgmmIiUnPlQCBtpgciun61LLE50hk7

ejNtkPmEHUUaJfe9cQ6tmM6K8gxVD2LEWUTknp5XFQFOWUeKa24zRf

5. https://cyberwars.cydefencetn.com/

1.2 April

1.2.1 Dancho Danchev’s Video Interview at Bulgaria 24’s "Cyber Wars" TV Show (2023-04-01 20:43)
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[1]

Dear blog readers,

Feel like watching my latest and what appears to be first video interview on Bulgaria’s national television Bulgaria 24’s "Cyber Wars" TV show?

Watch it [2]here or [3]here.

Stay tuned!

1. https://blogger.googleusercontent.com/img/a/AVvXsEiJZIncIG78hJV8OuW7NrXQICnYldgzGTpJYSZ13IaN-2ywaUC0jGJAtq

RR9RrsB0j8-dEwIWeKKWxpkEW16meGWyA8NyPDHHvr5SWj315JVb2D

2. https://drive.google.com/file/d/1r80C9mtHayAar-boeC2vlFWwvouC2qGj/view?usp=drivesdk

3. https://youtu.be/plplc3wvaaM

1.2.2 Exposing the Fashion Brands of the Conti Ransomware Group (2023-04-06 23:43)

[1]
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Dear blog readers,

I’ve decided to share with everyone a series of photos obtained by data mining the recently leaked Conti ransomware gang’s internal communications with the idea to raise awareness on some of the fashion brands supposedly managed and operated by members of the

[2]Conti ransomware gang.

Sample personally identifiable information:

hxxp://www.wildberries.ru/brands/leylo

hxxp://instagram.com/leylo _wear

leyloekb@gmail.com

+7-912-633-13-03

hxxp://leylo.ru/
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hxxp://vk.com/leylo _wear

Sample photos include:

[3]

[4]
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[5]
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[6]
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[7]
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[8]
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[9]
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[10]

429



[11]

430



Stay tuned!

1. https://blogger.googleusercontent.com/img/a/AVvXsEiQymG8PAVYIGjmDQu6-A2sg3K_RZdcoCAsxBPSnOHoURfYhUReYSdCXI

dK8dYfX6W3GikYK_WxPlmWNYbhfQDRXH_q_KnqY0V4tj5Sfk1WBvMj

2. https://ddanchev.blogspot.com/2022/02/exposing-conti-ransomware-gang-osint_28.html

3. https://blogger.googleusercontent.com/img/a/AVvXsEgy7Sd5Vrev4fxiglTEC-nryhutbVfayXxfPBbF8SKnDRtLNukXbIwPH6

JZhM2Czf5nbFuJMYkktzdOnGRxfWwyWw_GudItcbCdbcmo0iTx0mbd

4. https://blogger.googleusercontent.com/img/a/AVvXsEhHkd8T3-zWaLY4lLHEtQBNUnlc_OuWOoOT6CL8wGfi3Nvz-95ztFvQIp

ymPMaaRk21ddyo4RqOkQ7wxbR-8Y3BX3eVQHUJPPo4oCkFcrT_61zE

5. https://blogger.googleusercontent.com/img/a/AVvXsEiqnaqLfuBKF-e9svRGEUinMELxNgIdiwtc8jay-KsTmJuENpM16I7uLN

2PD6501kV9hJIRThbCONlIzi_lCrqV3duTnmQAXd2p9F8pPwY1cY2c

6. https://blogger.googleusercontent.com/img/a/AVvXsEi4ehrsixuDfLYH27Tp2-240UwdHsfXCMotG5kUy0vGBFBG1CuWzdu2ta

GldqngSHxAy_1VsGcAstRCPbcfopYfSDdpJ29kjvCWzRDafM9R0IQv

7. https://blogger.googleusercontent.com/img/a/AVvXsEjOJSv23_-EhpZavVbBeTY9IEt9XTNTxBrK7pIBCV5ZK_Fe5tB5eLisiy

Y0qhrWRvNpUP3G37nq3stgVoEI5M4R0rjC5jx4idnOuU6aX5Bct5G4

8. https://blogger.googleusercontent.com/img/a/AVvXsEiWzK9cLOl3GEpIqk16r9jPi-ApBlsEDrOTVJHYm_enZ7DLYFCwKBF5Ai
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ue17ZdQJySZ-zQGDhm6fvqFN7i9kngoq63IeomFT776HJST4j6LsoL

9. https://blogger.googleusercontent.com/img/a/AVvXsEiREoaLWjdpwe2watCE9kMYOtZFy1oRQJ_SOASR4-eeoq5yKBP4RNkOEs

OnKHKSw8xToyVQMLhs9RcG0Tqt7bVKVxB6zDkNpUYgbo0WAQnHW56E

10.

https://blogger.googleusercontent.com/img/a/AVvXsEjzTEGNfR6-nSbhznSxaQks15TnPUCVNbfJBNTW0Gpro1BgV54L8sDL

xvseoyUWy_z1PwdHjhzhbxykYntVzf5Ki_g6QH6b6A_GazLkEd-ijWxR

11.

https://blogger.googleusercontent.com/img/a/AVvXsEhLfk0fJSdI02YPsXsnWPMe9B0ry_X0rQrNmRSz0ThVC-z9xGuADpNA

APGrq6aQTcRlSJMkEERCe5D9MFdBDmkZc7Ln_5pQp8-6h7Nywe8lVRUW

1.2.3 Profiling the Internet Connected Infrastructure of the Genesis Market Cybercrime-Friendly Online Marketplace (2023-04-06 23:43)

[1]

Dear blog readers,

I’ve decided to take a deeper look inside the Internet connected infrastructure of the recently seized Genesis Market cybercrime-friendly marketplace with the idea to provide actionable intelligence and to assist vendors organizations and researchers including U.S Law Enforcement on its way to properly track down and monitor the cybercriminals behind these campaigns.

Related Genesis Market domains:

hxxp://sync[.]genesis-update[.]net

hxxp://sync[.]genesis-security[.]net

hxxp://g3n3sis[.]pro
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hxxp://xmpp[.]genesis[.]market

hxxp://genesis[.]marjet

hxxp://g3n3sis[.]org

hxxp://sync[.]gsconnects[.]com

hxxp://g3n3sis[.]org

hxxp://g3n3sis[.]pro

hxxp://g3n3sis[.]me

Sample IPs known to have been involved in the campaign include:

• 195[.]206[.]181[.]217

hxxp://sync.genesis-update.net

hxxp://sync.genesis-security.net

hxxp://g3n3sis.pro

hxxp://xmpp.genesis.market

• 89[.]44[.]9[.]110

hxxp://genesis.marjet

hxxp://g3n3sis.org

hxxp://sync.gsconnects.com

• 89[.]42[.]212[.]194

• 163[.]172[.]125[.]48

hxxp://genesis.marjet

hxxp://g3n3sis.org

hxxp://sync.gsconnects.com

Sample related domains:

hxxp://softexpertupdate.com

hxxp://cms.softexpertupdate.com

hxxp://179.43.157.79.mywebccon.us

hxxp://seed.bitcoinstats.com

hxxp://dnsseed.bluematt.me

hxxp://psql04.exoffer.net

hxxp://pornnhub.net

hxxp://status.softexpertupdate.com

hxxp://www.exoffer.net
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hxxp://portal.softexpertupdate.com

hxxp://server.softexpertupdate.com

hxxp://www.softexpertupdate.com

hxxp://mysql.softexpertupdate.com

hxxp://nationalcasino-pl.org

hxxp://g3n3sis.pro

hxxp://sync.genesis-security.net

hxxp://g3n3sis.org

hxxp://www.pornnhub.net

hxxp://mail.pornnhub.net

hxxp://vps.pornnhub.net

hxxp://ww1.pornnhub.net

hxxp://ftp.pornnhub.net

hxxp://vpn.pornnhub.net

hxxp://mx.pornnhub.net

hxxp://app.pornnhub.net

hxxp://hostmaster.pornnhub.net

hxxp://sync.genesis-update.net

hxxp://remote.pornnhub.net

hxxp://server.pornnhub.net

hxxp://stage.pornnhub.net

hxxp://citrix.pornnhub.net

hxxp://email.pornnhub.net

hxxp://files.pornnhub.net

Sample IPs:

• 179[.]43[.]157[.]79

hxxp://exoffer[.]net - Email: lisadaley0024@gmail[.]com

hxxp://softexpertupdate[.]com - Email: proprivxx@rambler[.]ru

• 179[.]43[.]157[.]79

hxxp://pornnhub[.]net - Email: mertvural@mynet[.]com; vuralmert@mynet[.]com hxxp://exoffer[.]net

hxxp://123nextgift[.]com

hxxp://update-flash[.]net
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hxxp://recallsystem[.]net

hxxp://flash-update[.]net

hxxp://k7m58z65g32t[.]net

hxxp://filesbase[.]net - Email:

aleksei[.]rqbakov@mail[.]ru - hxxp://realstatistics[.]info;

hxxp://webstatisticspro[.]net

hxxp://softexpertupdate[.]com

hxxp://pornnhub[.]net

Dots dots dots. We’ve already got the aleksei.rqbakov@mail.ru email profiled [2]here.

Sample screenshots include:

[3]

[4]
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[5]

Stay tuned!
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1. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhai7DB6ZPP-HU-hWTrvvuI3Be2_XjEiadyrY8rwz7194stV

PEti74wJubWrVJeirE-ApSUZ852at0F_TTkeTo-jxu8i-9Ua5M1G4H

2. https://www.forcepoint.com/blog/x-labs/uncovering-malicious-traffic-direction-system-blackhat-tds

3. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgPIUJaI9SEvBonRlPVtPzpTDE2NQJtMk_QyJbx_zLr9e1Pw

BQKN2J9C4s8_lTlu3tYpZ66rQE2DgygOMduJianqyUn2rbR8zjtMwh

4. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh5VI2zeXBV3cb_GbBMXdMTM73A0fpG78gbkYQpMAVh3MBsl

aAlEH4LTL7gaMNddMfR23GOjcKp2D1cEz-CTp2qjuTo4mQoUBDrYPw

5. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjIclRj9kHPVtz_IHrzLZ0GJZQz45PdvjRjfgr6SkXARRyqx

1Zor9zAtGqUJ2vFmz39I-kbVnJ2vElTV_0MelwnlXjnu0okqXmV8ss

1.2.4 Exposing a Currently Active Domain Portfolio of E-Shops for Stolen Credit Cards Information (2023-04-10 12:10)

[1]

Dear blog readers,

I’ve decided to share with everyone a set of upcoming blog posts on the market for E-Shops for stolen and compromised credit card details with the idea to raise everyone’s awareness on the topic and the proliferation and easy to use and launch E-Shops for stolen and compromised credit card details.

Sample personally identifiable email address accounts known to have been involved in the campaign include:

MSMAZEVEDO@GMAIL[.]COM

imakoos85@gmail[.]com

kang[.]hr[.]ig@gmail[.]com

powerdave1@gmail[.]com

lunaritsolution@outlook[.]com

ajewoletimmy@gmail[.]com
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saarsoftware@gmail[.]com

bluetextmama@gmail[.]com

ea1958@gmail[.]com

enguyen[.]fr@gmail[.]com

Sample responding IPs known to have been involved in the campaign include: 47[.]74[.]137[.]231

47[.]74[.]235[.]179

27[.]102[.]128[.]164

149[.]129[.]136[.]150

92[.]38[.]135[.]251

47[.]74[.]177[.]133

46[.]21[.]248[.]49

47[.]74[.]236[.]158

62[.]76[.]44[.]254

47[.]52[.]233[.]0

194[.]147[.]34[.]82

209[.]99[.]40[.]226

195[.]2[.]67[.]107

45[.]153[.]230[.]30

185[.]240[.]103[.]226

185[.]14[.]30[.]108

5[.]188[.]89[.]85

54[.]197[.]0[.]101

92[.]38[.]160[.]4

188[.]166[.]32[.]65

47[.]74[.]176[.]64

92[.]242[.]40[.]127

185[.]217[.]199[.]57

95[.]181[.]157[.]180

161[.]117[.]7[.]46

149[.]129[.]226[.]244

209[.]99[.]40[.]227

47[.]52[.]142[.]249

95[.]161[.]129[.]77

35[.]180[.]38[.]166
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91[.]225[.]216[.]6

193[.]187[.]175[.]159

149[.]129[.]240[.]26

88[.]119[.]179[.]216

149[.]129[.]215[.]190

172[.]67[.]223[.]35

47[.]74[.]184[.]97

49[.]51[.]85[.]205

18[.]118[.]254[.]174

46[.]173[.]214[.]200

91[.]227[.]18[.]166

192[.]3[.]80[.]115

47[.]88[.]158[.]202

45[.]153[.]73[.]8

185[.]203[.]240[.]80

185[.]159[.]129[.]106

104[.]18[.]46[.]127

172[.]67[.]195[.]158

104[.]18[.]37[.]112

188[.]114[.]99[.]128

104[.]21[.]36[.]194

104[.]18[.]36[.]112

172[.]67[.]198[.]196

172[.]64[.]87[.]81

188[.]114[.]96[.]3

104[.]21[.]79[.]214

188[.]114[.]97[.]14

172[.]64[.]92[.]205

20[.]102[.]115[.]223

176[.]119[.]156[.]198

78[.]155[.]207[.]76

47[.]254[.]213[.]246

95[.]181[.]179[.]111

47[.]88[.]156[.]38

91[.]203[.]192[.]138
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27[.]102[.]102[.]120

193[.]70[.]95[.]200

188[.]114[.]96[.]14

213[.]183[.]61[.]45

104[.]24[.]118[.]30

92[.]38[.]135[.]185

172[.]67[.]138[.]127

188[.]114[.]96[.]9

146[.]112[.]61[.]107

172[.]67[.]135[.]89

104[.]24[.]119[.]30

188[.]114[.]97[.]15

192[.]42[.]118[.]104

172[.]67[.]184[.]64

88[.]119[.]179[.]132

47[.]74[.]176[.]216

194[.]53[.]111[.]251

185[.]180[.]231[.]7

13[.]57[.]17[.]224

104[.]31[.]76[.]164

149[.]129[.]216[.]197

198[.]105[.]254[.]11

104[.]31[.]77[.]164

34[.]209[.]208[.]254

91[.]92[.]144[.]15

104[.]21[.]32[.]66

52[.]26[.]159[.]124

104[.]21[.]52[.]206

172[.]67[.]203[.]167

104[.]24[.]97[.]90

46[.]21[.]249[.]114

95[.]213[.]203[.]64

104[.]24[.]96[.]90

149[.]129[.]219[.]23

85[.]119[.]150[.]155
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134[.]122[.]46[.]76

46[.]173[.]215[.]186

91[.]203[.]192[.]190

192[.]3[.]161[.]183

34[.]98[.]99[.]30

176[.]107[.]160[.]148

45[.]143[.]136[.]148

142[.]93[.]122[.]253

89[.]32[.]41[.]139

194[.]67[.]71[.]134

176[.]124[.]193[.]77

150[.]109[.]48[.]71

185[.]244[.]183[.]252

45[.]143[.]137[.]41

95[.]213[.]252[.]3

18[.]220[.]144[.]78

161[.]117[.]12[.]56

185[.]233[.]0[.]27

46[.]148[.]113[.]207

109[.]70[.]26[.]37

91[.]194[.]3[.]84

185[.]224[.]212[.]28

193[.]187[.]128[.]22

92[.]38[.]135[.]250

94[.]250[.]252[.]7

185[.]224[.]212[.]29

91[.]203[.]193[.]132

194[.]67[.]71[.]93

185[.]212[.]129[.]246

5[.]178[.]2[.]230

92[.]53[.]77[.]40

185[.]241[.]54[.]112

92[.]242[.]40[.]199

34[.]219[.]55[.]209

2[.]57[.]187[.]160

441

141[.]98[.]134[.]31

213[.]189[.]219[.]6

192[.]162[.]246[.]117

213[.]59[.]127[.]192

104[.]18[.]38[.]216

185[.]93[.]109[.]250

78[.]155[.]206[.]161

62[.]75[.]207[.]166

195[.]140[.]147[.]9

91[.]142[.]78[.]202

95[.]181[.]157[.]128

91[.]199[.]147[.]94

45[.]156[.]119[.]4

92[.]53[.]77[.]90

176[.]124[.]193[.]25

44[.]192[.]59[.]70

23[.]147[.]229[.]205

193[.]187[.]175[.]33

194[.]87[.]101[.]3

45[.]85[.]117[.]104

194[.]85[.]61[.]76

62[.]77[.]154[.]3

195[.]123[.]221[.]141

193[.]187[.]174[.]103

127[.]0[.]0[.]1

104[.]24[.]112[.]44

91[.]203[.]193[.]176

193[.]187[.]175[.]104

194[.]147[.]35[.]176

47[.]254[.]201[.]251

5[.]178[.]2[.]98

94[.]130[.]10[.]95

Related domains known to have been involved in the campaign include: hxxp://approved-cc[.]ru

hxxp://approved-shop[.]be
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hxxp://approved-shop[.]su

hxxp://approved[.]moscow

hxxp://approvedbazar[.]ru

hxxp://bases-valid[.]com

hxxp://bazar-vclub[.]su

hxxp://bingodumps[.]ru

hxxp://cardcase[.]ru

hxxp://carderbasesu[.]ru

hxxp://carderprofit[.]pl

hxxp://cardershop[.]pl

hxxp://carderstore[.]su

hxxp://cardersvilla[.]ru

hxxp://cardhouse[.]be

hxxp://carding-forumcc[.]ru

hxxp://carding-world[.]com

hxxp://cardingcvv[.]pl

hxxp://cardingcvv[.]su

hxxp://cardingforums[.]su

hxxp://cardingmaestro[.]com

hxxp://cardingpro[.]ru

hxxp://cardmafia[.]ru

hxxp://cardsmarket[.]su

hxxp://cardstorm[.]su

hxxp://cardvilla[.]pl

hxxp://cc-shop[.]me

hxxp://cc-shop[.]pl

hxxp://cc-stock[.]su

hxxp://ccclc[.]ru

hxxp://ccfullz[.]su

hxxp://ccfullzshop[.]su

hxxp://ccshoponline[.]org

hxxp://ccstores[.]su

hxxp://ccvv2dumps[.]com

hxxp://centralshop[.]im

hxxp://centralshop[.]moscow
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hxxp://cf[.]myrecensioni[.]it

hxxp://charlotteshop[.]tk

hxxp://cheapcvv[.]su

hxxp://chinadump[.]ru

hxxp://cvs[.]ripcc[.]ru

hxxp://cvv-fresh-shop[.]ru

hxxp://cvv-seller[.]ru

hxxp://cvv-shop[.]cc

hxxp://cvv-shop[.]pl

hxxp://cvv2shop[.]me

hxxp://cvv2u[.]su

hxxp://cvvbank[.]ru

hxxp://cvvcarders[.]com

hxxp://cvvdump[.]com

hxxp://cvvforsale[.]com

hxxp://cvvlist[.]info

hxxp://cvvme-shop[.]me

hxxp://cvvonlineshops[.]com

hxxp://cvvshop39[.]su

hxxp://cvvshoponline[.]ru

hxxp://cvvshops[.]su

hxxp://cvvunion-cvv[.]su

hxxp://cvvunion-store[.]su

hxxp://cvvunion[.]me

hxxp://d4rksys[.]ru

hxxp://dark-sell[.]ru

hxxp://darkcarders[.]ru

hxxp://darkteam[.]ru

hxxp://dump-shop[.]pl

hxxp://dump99[.]com

hxxp://dumps247[.]su

hxxp://dumps4free[.]ru

hxxp://dumpsbuycvv[.]com

hxxp://dumpscenter[.]name

hxxp://dumpscvv2[.]net
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hxxp://dumpshop[.]online

hxxp://dumpskingdom[.]biz

hxxp://dumpsmall[.]name

hxxp://dumpsshop[.]pl

hxxp://dumpsvendor[.]su

hxxp://dumpswithpin[.]pl

hxxp://golddumps[.]net

hxxp://goldplastic[.]store

hxxp://gooddumps[.]ru

hxxp://gorod-grekhov[.]su

hxxp://gownscode[.]com

hxxp://greatdump[.]ru

hxxp://greatdumps[.]net

hxxp://greatdumpsshop[.]ru

hxxp://greatdumpz[.]ru

hxxp://gsp[.]mptc-store[.]de

hxxp://gttrendsvideo[.]cf

hxxp://gullashop[.]ru

hxxp://cvv-store[.]ru

hxxp://allworld-cc[.]ru

hxxp://altenen-forum[.]ru

hxxp://altenens[.]ru

hxxp://approved-bazar[.]su

hxxp://bulletproof-hosting[.]su

hxxp://cardmarket[.]su

hxxp://crdsu-forum[.]su

hxxp://cremecreps[.]su

hxxp://cvv2-shop[.]ru

hxxp://cvv2[.]in

hxxp://cvv3[.]ru

hxxp://daymart[.]co

hxxp://deluxedumps[.]su

hxxp://diamondumps[.]net

hxxp://doomday[.]ru

hxxp://dragonara[.]su
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hxxp://fastflux[.]su

hxxp://feshop-reserve[.]com

hxxp://freshbay[.]pl

hxxp://fullzinfo[.]ru

hxxp://hygienely[.]com

hxxp://jokerstash[.]club

hxxp://jshop-com[.]ru

hxxp://masttatoo[.]com

hxxp://mejorespaginasdecitas[.]xyz

hxxp://n-perspektiva[.]ru

hxxp://pinkshop[.]info

hxxp://riclub[.]ru

hxxp://serferio[.]ru

hxxp://shopcvvdumps[.]ru

hxxp://snakeshophk[.]ru

hxxp://storecvv[.]ru

hxxp://tuneshop[.]su

hxxp://undef-cvv[.]su

hxxp://undefinfo[.]su

hxxp://uniccfreecc[.]ru

hxxp://validccseller[.]pl

hxxp://validmn[.]ru

hxxp://validms-store[.]ru

hxxp://vclub-shop[.]su

hxxp://yalelodge-cm[.]ru

hxxp://yourmoney24[.]ru

hxxp://hackforum[.]su

hxxp://crdshop[.]be

hxxp://approvedbazar-market[.]su

hxxp://honeymoney[.]su

hxxp://bestvacancy[.]ru

hxxp://acc-sell[.]ru

hxxp://shopbuycvvwithpaypal[.]ru

hxxp://shop-credit-card-dumps-reddit[.]ru

hxxp://shop-cvv-shop-2019[.]ru
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hxxp://shop-uni-cc-shop[.]ru

hxxp://darkmarket[.]su

hxxp://ccheaven[.]org

hxxp://lulzsec[.]ru

hxxp://forumcarder[.]com

hxxp://valid-shop[.]com

hxxp://bestbins[.]ru

hxxp://braindumps[.]su

hxxp://ccreviews[.]su

hxxp://allcarders[.]ru

hxxp://allotrope[.]hotspotproxy[.]xyz

hxxp://allworld-cards[.]ru

hxxp://altenen[.]su

hxxp://antispam[.]7vkontakte[.]ru

hxxp://apache[.]novlops[.]com

hxxp://apache[.]www[.]ktmstore[.]su

hxxp://api[.]lriccardo[.]com

hxxp://apps[.]foto-golie-tela-devochek[.]cvvshop1[.]su

hxxp://apps[.]www[.]c4c[.]su

hxxp://appsman[.]xyz

hxxp://argovpnfalconn[.]gq

hxxp://artisticimpressionsuk[.]com

hxxp://atcarpu[.]gq

hxxp://atomstroy[.]net

hxxp://auto-vils[.]ru

hxxp://avantprojects-gh[.]com

hxxp://awhf9[.]udbbup[.]com[.]cn

hxxp://b-hls-05[.]strpst[.]com

hxxp://bankomat[.]be

hxxp://barbican[.]tv

hxxp://barracuda[.]7vkontakte[.]ru

hxxp://before[.]inatticlarijf[.]cf

hxxp://bgptools-wildcard-confirmed[.]googbarunfe[.]ml

hxxp://bgptools-wildcard-confirmed[.]xn–80abewf6ayd1f[.]xn–p1ai

hxxp://bigfat[.]cz
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hxxp://bilaushop[.]me

hxxp://bins[.]group

hxxp://bitz-exchange[.]com

hxxp://bl3nda[.]se

hxxp://blog[.]ilimit[.]es

hxxp://bnro[.]altronik-planet[.]ru

hxxp://briansclub[.]ru

hxxp://brocard1[.]com

hxxp://brocard1[.]ru

hxxp://brutal55[.]com

hxxp://bs[.]a3-sport[.]ru

hxxp://buybanklogin[.]ru

hxxp://buyccfullz[.]ru

hxxp://buycvv[.]pl

hxxp://buycvvdumps[.]ru

hxxp://buydumpswithpinonline[.]info

hxxp://cdn[.]www[.]transvistiti-onlayn-porno-video[.]geek-mods[. ]su hxxp://chartgalmacounse[.]tk

hxxp://chr[.]levafara[.]com

hxxp://circleofillusion[.]com

hxxp://citrix[.]nickstuff[.]su

hxxp://citrix[.]www[.]filmi-porno-na-russkom-yazike-onlayn[.]dcshop [.]su hxxp://ckout[.]com

hxxp://cluseabonanenac[.]tk

hxxp://cmishop[.]ru

hxxp://cms[.]wucshop[.]com

hxxp://collotype[.]iproxy[.]cloud

hxxp://condescending-ellis[.]91-92-144-15[.]plesk[.]page

hxxp://confin[.]cf

hxxp://corp[.]batch-conf[.]com

hxxp://corp[.]blackstuff[.]name

hxxp://crdclub[.]pl

hxxp://crudepan[.]club

hxxp://cryptopia-exchange[.]com

hxxp://current[.]everyday[.]shall[.]vasle[.]gov–ir[.]ml
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hxxp://currie[.]kilegofiqajore[.]xyz

hxxp://d313t3dr35t0r3[.]we-n0v3nn63r-pee-2o2o-en[.]ga

hxxp://dc-49827949[.]ltdcc[.]su

hxxp://delim-money[.]ru

hxxp://devtest[.]blackstuff[.]name

hxxp://devtest[.]geek-mods[.]su

hxxp://direct[.]track-online-shop[.]top

hxxp://domainxueinsssss[.]to

hxxp://donnellwtpurslow[.]tk

hxxp://doprava-svet[.]cam

hxxp://dpk24[.]ru

hxxp://dtstudio[.]ru

hxxp://dwwraavlnnvspi[.]guests[.]nchotel[.]com

hxxp://e-obmen[.]su

hxxp://e-signature[.]trytiptop[.]app

hxxp://ebin[.]moscow

hxxp://eechufee4oow2r[.]freshcvv2[.]su

hxxp://en[.]topvccardingshop[.]top

hxxp://eureka[.]in[.]net

hxxp://exchange[.]powerdumps[.]su

hxxp://f5[.]shop-cvv-valid[.]ru

hxxp://fast-flux[.]net

hxxp://fe-acc18-shop[.]ru

hxxp://feacc18-store[.]ru

hxxp://feacc18-verified[.]su

hxxp://feacc18[.]su

hxxp://feprivate[.]com

hxxp://feshop-card[.]su

hxxp://feshop[.]com[.]ng

hxxp://feshop[.]kz

hxxp://feshop[.]pl

hxxp://festore-dumps[.]com

hxxp://fisopuwing[.]cf

hxxp://flowbtc[.]biz

hxxp://flowglass[.]com[.]au
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hxxp://forum[.]cardersbay[.]ru

hxxp://foto-devushek-z-golimi-popkami[.]cvvshop1[.]su

hxxp://franunbeadisbe[.]ml

hxxp://freelife[.]blisslife[.]ru

hxxp://freiexchange[.]net

hxxp://freshcasinos-can[.]ru

hxxp://freshstuffpro[.]biz

hxxp://ftp[.]carderescrow[.]com

hxxp://ftp[.]ccvv2dumps[.]com

hxxp://ftp[.]cvv2-shop-online[.]com

hxxp://ftp[.]radiolom-moskva[.]ru

hxxp://ftp[.]sellcvv[.]biz

hxxp://ftp[.]shalomninja-market[.]su

hxxp://ftp[.]simplenews[.]ru

hxxp://fulls-sale[.]ru

hxxp://fullzbuyorg[.]ru

hxxp://fullzstore[.]pl

hxxp://fvcmhw[.]swodigital[.]it

hxxp://gamershome[.]biz

hxxp://games[.]tnxkfo[.]icu

hxxp://gayva-plus[.]ru

hxxp://gdzlsz[.]com

hxxp://getbette[.]su

hxxp://getcc[.]biz

hxxp://gfezaby[.]tk
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hxxp://fresh-cvv-shop[.]ru

hxxp://heaven-shop[.]com

hxxp://freshstore[.]su

463

hxxp://backstab[.]su

hxxp://cvvsale-shop[.]ru

hxxp://try2swipe[.]su

hxxp://unicvv-ru[.]su

hxxp://powerdumps[.]su

hxxp://lampeduza[.]su

hxxp://allworld-store[.]su

hxxp://shoponline-dumps[.]top

hxxp://ccguru[.]su

hxxp://blackcc[.]net

hxxp://cvv-seller[.]su

hxxp://mkdumps[.]com

hxxp://approvedcc[.]ru

hxxp://carderscave[.]su

hxxp://2tracks[.]biz

hxxp://cvvshopvalid[.]ru

hxxp://dumps[.]moscow

hxxp://crdpro[.]net

hxxp://cardshop[.]su

hxxp://cvvshopverified[.]top

hxxp://fullzshop[.]pl

hxxp://mail[.]redselo[.]ru

hxxp://russiancarders[.]su

hxxp://biz[.]nsc-monolit[.]ru

hxxp://dailyupdate[.]su

hxxp://megadumps[.]su

hxxp://stdumps[.]su

hxxp://grmtech[.]net

hxxp://validcard[.]su

hxxp://shop-cvvunion[.]ru

hxxp://voltstore[.]biz

hxxp://cc-shop[.]su

hxxp://val1d[.]ru

hxxp:/skizdumps[.]su

hxxp://web-hack[.]su

464





hxxp://rescator[.]su

hxxp://spam-market[.]su

Stay tuned!

1. https://blogger.googleusercontent.com/img/a/AVvXsEiiH0xyz3mct0cqaMgMRKKN_poabppCPpyVr-BEU5oHN2WYmVphEQJF4N

EKjexrIEHgxdRARz-HJ91ZYCfmcY7BjUuiWoi72NfXhkPo0tKOuma2

1.2.5 Profiling the Internet Connected Infrastructure of the Genesis Market Cybercrime-Friendly Online Marketplace - Part Two (2023-04-10 12:11)

[1]

Dear blog readers,

I’ve decided to dig a little bit deeper inside [2]Genesis Market’s Internet-connected infrastructure for the purpose of providing vendors researchers and organizations including U.S Law Enforcement with additional insights into the Internet-connected infrastructure of the cybercrime-friendly forum marketplace.

As I was able to find several other related domains known to have been affiliated in the campaign both currently and historically I’ve managed to track down and connect 465

the dots between the currently active Genesis Market Internet-connected infrastructure and a well known traffic acquisition hijacking and management for malicious purposes campaign ([3]aleksei.rqbakov@mail.ru) including a (hxxp://applyinfo[.]org) - [4]DarkHotel Cyber Espionage related email (hxxp://anteph[.]org) - [5]PushDo malware campaign affiliated email (hxxp://darkhero[.]org) - [6]Threat Group 3390 Cyber Espionage related email (hxxp://googmail[.]org) - [7]Uyghur Targeted Malware campaign related email (hxxp://updateonlines[.]org) - [8]Threat Group 3390 Cyber Espionage related email.

Here are all of Genesis Market’s primary domains:

hxxp://tracecontrol[.]net

hxxp://genesis-security[.]net

hxxp://gsconnects[.]com

hxxp://g3n3sis[.]net

hxxp://approveconnects[.]com

hxxp://genesis-update[.]net

hxxp://g3n3sis[.]su

hxxp://gen2dev[.]net

hxxp://tracecontrol[.]net - Email: jose@webcontrolmultimedia[.]com Related domains:

hxxp://clavedifusa[.]com

hxxp://tracecontrol[.]net

hxxp://ipcontrol[.]org - Email: snowyowl@jpnsec[.]com

hxxp://spainsfain[.]com

hxxp://fatagallery[.]net

hxxp://pingcontrol[.]com

-

Email:

gherasim@gherasim[.]net;

CUSTOMERSER-

VICE@RECWEAR[.]COM

hxxp://vmcontrol[.]com

hxxp://activosenrenta[.]com

Related domains:

snowyowl@jpnsec[.]com -

anteph[.]org

-

Email:

michellewmowbray@jourrapide[.]com;

compacx@gmail[.]com;

put[.]a[.]feud[.]pike011235@gmail[.]com; compac@vianw[.]pta

applyinfo[.]org - Email: gerben _habets@163[.]com

darkhero[.]org - Email: ykcaihyl@163[.]com; dddd@aol[.]com

googmail[.]org - Email: xsldmt@xj163[.]cn; cmickler@mpi-klsb.mpg[.]de update-onlines[.]org - Email: working _success@163[.]com

Related email address accounts known to have been used in the campaign include: michellewmowbray@jourrapide[.]com

compacx@gmail[.]com

466

put[.]a[.]feud[.]pike011235@gmail[.]com

compac@vianw[.]pt

gerben _habets@163[.]com

ykcaihyl@163[.]com

dddd@aol[.]com

xsldmt@xj163[.]cn

cmickler@mpi-klsb[.]mpg[.]de

working _success@163[.]com

Related domains:

hxxp://windows-updateonlines[.]com

hxxp://xjyqgy[.]com

hxxp://update-onlines[.]org

hxxp://videototal[.]net

hxxp://bonitimovel[.]com

hxxp://wjuci[.]com

hxxp://googmail[.]org

hxxp://anteph[.]org

hxxp://utvsoft[.]com

hxxp://xjcoop[.]com

hxxp://yourturbe[.]org

hxxp://ufoneconference[.]com

hxxp://websurprisemail[.]com

hxxp://prehospitalar[.]com

hxxp://githubs[.]net

hxxp://centr-info[.]com

hxxp://fordae[.]com

hxxp://compac[.]org

hxxp://darkhero[.]org

hxxp://blackcmd[.]com

hxxp://xjbtwy[.]com

hxxp://applyinfo[.]org

hxxp://lnip[.]org

hxxp://hotmail-onlines[.]com

Related MD5s:

c37e425ab2366aabb29bdf1f60e83c44

467

d1ebbf32300714fd23f16185719ab473

d7cf0d1616baa3060d1dbf8fcf411671

9045590085f6f7aa4f0ea54b7f7e984e

2c6633d4742c48fcfb73f570389f0d47

d8db244325ab164e15adb9a160ff2c2a

c8c169500721e61600ea5e062b3f2bc1

bb103a7b1862c3fd80540b0e34af932d

2d89597e896acb68fa7eec31a2760a23

9821cb7495d27f2d3294056d4bcd5a0f

07901d628998cac067c502309336e4ea

bd1578145c717fff719593b54bf58839

2a3321754286c94e361f082df1a58374

95ee6379cb6e3d582f961f2948ceab51

6cf93258d26080abd9390ba0fe047a91

53bbf30a0a7beb37f6bcc533e261160b

931c3a69f93bbd77d6a117a909d0da1f

gherasim@gherasim[.]net -

hxxp://ptchotels[.]com

hxxp://e-tops[.]com

hxxp://cavhosting[.]com

hxxp://cavhosting[.]org

hxxp://gherasim[.]org

hxxp://coonnet[.]org

hxxp://netallow[.]com

hxxp://coonnet[.]net

hxxp://mouseb[.]com

hxxp://mouseh[.]com

hxxp://netallow[.]org

hxxp://pingcontrol[.]org

hxxp://ptcvoucher[.]com

hxxp://gherasim[.]net

hxxp://cavsystems[.]org

hxxp://cavsystems[.]net

hxxp://jsay[.]net

hxxp://netallow[.]net

468

hxxp://coonnet[.]com

hxxp://pingcontrol[.]com

CUSTOMERSERVICE@RECWEAR[.]COM

hxxp://numanna[.]us

hxxp://megaready247[.]com

hxxp://megaready365[.]com

hxxp://recleaguetees[.]com

hxxp://customtshirtscheap[.]com

hxxp://symmetryrecovery[.]com

hxxp://mynumanna[.]asia

hxxp://astakeinzion[.]org

hxxp://teamnumanna[.]us

hxxp://teamnumanna[.]asia

hxxp://extrafundscapital[.]com

hxxp://extramittel[.]com

hxxp://astakeinzion[.]net

hxxp://210abbeylane[.]com

hxxp://mynumanna[.]us

hxxp://megareadyfoodstorage[.]com

hxxp://megareadygarden[.]com

hxxp://megareadyfood[.]com

hxxp://megareadyfoods[.]com

hxxp://megareadymeals[.]com

hxxp://megareadystorage[.]com

hxxp://megareadyhealth[.]com

hxxp://megareadymeal[.]com

hxxp://extrafondsen[.]com

hxxp://wirefastcash[.]com

hxxp://extrafondi[.]com

hxxp://extrafonds[.]com

hxxp://yourextrafunds[.]com

hxxp://promobandit[.]com

hxxp://extrafundsllc[.]com

hxxp://veganhockeyboy[.]com

Related MD5s:

469

f5b80a40b71e398e58aed6d7be113f33

2cbfd2493b885f916f801532d84cada3

224f911bf8f79dafaa37485bcdd8dd26

f11b345eca71b40b409dfbc30b645e0b

83f0351c5fde747e94da2135cc856f8e

dfcb97a2e9853b5cdfe3d04737540fa8

9111b9f55f195e2886b7bf1cbbe157fc

Related MD5s:

eb9127ee4da6199a85ad37dbbc31e950734dccbe99302821a0db70873ff5c8c5

e8d9c53057524cde5023c7eaeaab657bd24d18a4c7413c707ba74c1aad48e22c

ee343e563ac70b7c61d460dc8b8c59313fe1a212cb756f6757c46d05d29cc43b

ecaed016f8d7eb5473251b5d08249556ed9f590bf420f537b947727df42bdbca

e0bde12d823997a90111af6c6ae34962682f1a3f37d088da162a97dce4006976

e06d1d80e92573c0cfff62f80c60d0d870f11687f4816593a39e3cc65ee6087e

e69071c17b04b7c0e1378c8ced749d888b17a1222c9982055a51ed7a5a2a3f2c

e3f164bd260eea2d557010139e4a1d4addfecd6c86b39009ca7b43b148dd88c4

f6440701bf6518750afb7607ef0b2d4f589e5382b2501df413feb2caa8a4c5f7

f5cdba93d6708c64a9ddf46e89fd35a8b14ec8b39d91da44beeb3f8c23f8f3ac

f6f1587b229addb417b119571e3f563b1513b8a70911b08fb5e56dd13720a3c0

f6e56acf8c395b2e4104197c021313396b1f8b06e0bdd000a1416ad5166712f5

efbb6b3d6dd0c8b5604fd331fd8610dd8850d51469c96b746b421fae794138ff

ee5745b335a2e42267a666b2f6de15237a13f234b3fbc2703fa3071d7d076efd

f4ba500e1afbf2d5510c2bf8cc4be97803144188f50f7fd07f0e51c1f39ba635

f07916021a7b725c7f4b4ef2bcc47affe8354da1ce3d2e3e5377688ef5b8991c

d043f54aafdef07f2a40429ea7a549d0b500d385886ab7d9daa23f409aeea3fd

cfefd81feb339262d931024138a798ee2e2e36f248d3b35415680521e3da1012

d506e86ce47aac97e41a8b49a5dc4c410a3d9a86721264077a5f47adf5abc26b

d2f403175d4c92a6c533ffed2ce106c9048abfc2361cb76aa3e4a55c1af60ed0

ca3d9d1058f737c28c59c59f073cb765d114390cd0d2eb50150c18f594d8f20f

c91f3b99e822b86a21850c25281443ee01a84f88870632ed76387c391fb7c1a4

cc74241af99cbb3163d9fbbb47f8724151fd006ea82b1cdf885306b234b8d21f

cb9a5c7c97f3b258389e165f1ee5af27fae8761f9008198c0045a4b8f9011eb4

de0f791eac41b1fe17d9b9c3678011f2e10faf0aca96599a94efb26c8b7fe3a5

d8a600c47406a74a7fecaf91defcc1ae2dbcad6ccc001b0907c6c919287c7ae5

dfde4df8173b90daa38575d60c96bfc157e045a04e16e46bf073a64fdfd1285e

470

de615db896b1108d8a77ed1cbb97751c06697cc23a2c300e993667cde4966040

d5c8abad11880b65c7bb3a0c54dfde9fbb82c1b37f5a607ce6f6742cbf78e79a

d588a3a2690e20b2ad007e5315fad49cbbde95bd8dbf0a2b0f935fea21f32a19

d8670643faadd2a95b8525896e641e0a52d788e7a4b8e17b557f5b219e8af5c0

d6fafdf23381935d133060f4806bd70ba1b9a1ddecbd438157bac36dfa918996

fe3ee5a4fda0f22c1a65718c3dfe20d69c3b3c02e736e6f12702fd2ec6679f32

fab8a1a495d739034aa640e29aec3afbd39b764181ee073c56aa81bb5fef2cbf

ffcd0f962be910793ace6097f4775aef3cdb028ae838d87b225f0d8193c706d4

ff6e78dbd87594459e44ff6a8cdef3565103fa6032b66c79fc05aa9baf047a6c

f7d40c87e5e48cf86f39a5a7f71313f7650288be372f6474ce2701e170bcde23

f71adbbbf50fe122234b0675a7de09af1029e3d12456670bc796421ec55fa299

f8e697be3720186e1268f6068f7de550d7ab3cac374e46f322cf226119cfac84

f8763cdee254e54fca27f843a98a73e0d4158d1e16a8b64b578535efd1bf28f7

79e6f32ca08c52e94ba6e1f3bbef129f1e116444a1a9f9e1f4f7000e9b0ac436

65bbf0bd8c6e1ccdb60cf646d7084e1452cb111d97d21d6e8117b1944f3dc71e

088b2838be6e23f5581e949bf21533c617b12cb6e5fc210a91e7c3972bdd4048

07ab16d65a728b941454ee974cc24bdaa7b77a3dd1fb94dc84f1d04cf028a5e3

095134c4865a3e45735c0c795c029a3ddedf282b84b7fe8c7871fca9c2e6beed

08d71d9dd47c333d4123b4eba29c289fe2455cc30ea51274d53f3d67d51ae11f

048219709d1980f5220be5eacd29cd4776777ce0d0d96cd6f93f46877cb1f4ea

02fe1e05ca2f07215863e2a1fb3b5a00964ed07ffa2ddee45cf6ee8af10aff90

06b693c2fed892c2202318794f10a893a07dd66e6f6a8a809489e54596ebe5a2

068885c13a6c12d9bc49516c2683e38c9cd9b206eb7ab420257c449bbe44fae6

0e8e8c9da77fe5bb038a2fc189b1f3b142b7290409467c6ddc2c2f8b4b0a736f

0de1494f2732972d6a788f38c6442c0924cda8568bf21cb8f7b70e3f1a90ee8f

111d67ec13ea3d357da0ea2f6cf27665cc2ddb468d76f2c881357e7cedd77c72

10f99f9876ef9acc8d3e68cf15b5993ed116f46aa4de61ec90edb6bea944e13e

0976327d8f8751190c619ecc2a73ceca42e083c84518c52099a61aaa1f8fe507

095a3f84debd7481b880016a770c211a793847f61c72499b4702b16fd9666b28

0a6854535973cefac6e61598806ef1b8bcf982b4a7eac2d5120b8e8d44636d06

09c2d25d8d3aa14ab8817b57503477f2f53f7bbc30460d5c01866423233fb7bd

02c14e0d63ebeef4ce1b39985fce9dff8f0e8c33d09ed9f7d0ea2f446861c123

0239493645eb3dafcd10700b19b08a928b242a2441e566cf1211c57cd59e14ea

a3322b8e1ebd6728eca8848e53351d33918b6bc3e616a40abc761648c76f1c16

e466f005cdcc5ba42f14369c0148dc52fc699180bfba2f5eaa11cea8b0dee0fa

471

de222b9d0abf23f167389877d6a495d11d0232b523137b06920593eae55a759c 160aabd15d0a5f305bc9e6664bb5c6622af22f00882ef1c92afe9fcbdd2bc309

0c7de2aa0d28b725e7fd8e33395cd4ad22d97080af148b8cb94364bf79143e1c

d62ff85e39d8deb759286d85b0c12008aef868eac196e166894a1b0aa63ae380

bd0d5592958606e90b946f5473ff652720b685a78bf55b13314ec6a2576d88ea

dc13049f3b738e814ae2d68814e965b4e76fa165d936d842803bc7b549724b0e

d7b30c2c3aa6e7313e9d1f576c7ded2b0e6d824eb33a0bfc51bfe76dc4fc7539

2263eac303e3df68f6caf0d68473c1c2521eedaa1e62a26b2428db59d3fcfae9

1afdc11b6a94bfe2cb2e8808a1b57b7562fe01f9daf67f60ea99686753e48d20

76078813a8cc61d35b70af5e1a23914387a2352516447dbc2767f10116e2d2a2

27741622ff7b35d0c2616d3ade69fd23a2c58316e0da96c31319a0bdf90efc58

98680ca9454533c43e19271bfff605f6149820f4aa49af788b670b8a5d055508

95a91be8e27e821bb8d0a032bbda56af24ad3b72da01a025443246867cabcfb8

9933468292efeb6b2c9d2c8e36bbe818aebe7e46eeb6d7e25a8299b4e90f3ab6

987204ca82337f0a3f28097a5d66d5f3ecb11d43d82f67cd753d0bf2ce40b7a7

92c0cc5879215255478b3325bee34353090e08337aa61a92506f0498f7907500

8e35b5b98aed8865cf0d19f56d458415ddb62112d88802d8d0cdee9bf88aa7f5

94a0a09ee6a21526ac34d41eabf4ba603e9a30c26e6a1dc072ff45749dfb1fe1

9329488ad456177a8536525e4f9ee181b915479a8115045dedfb01ef97cd4179

a29cba8815bdc0aab28a09cc85a604d0782948c3fb95ee0e2220b1f0b9ea2954

9e08b0aa35564066e9096481b205db7b52d2fd3e3f82493fd4558e6f5cb2e12a

a318993ccfb20c1e13b488aa170db8cb4a7c2846d664348e538c1fa6d2b74304

a2fb381ec963c13e8791aac2fbd97080ab4fc3d776a80d2272a3624edb99cf8c

9b68e88576d7b929633b79c994ff4cf445325b18bc677abb22d962d8782cc663

9a5531e8fed2156cdaf1e166136dcb71be6c25e54bb7e54a3832d5121623b710

9d5dde5b73464bc057cefe3f3b65cbca4485eeec157b054ddef269cca7cf71f3

9c389badc989eae409ad6addb887115fa8bf2f13d110f9a4ea9140c6ff7dac0d

769057d643f1ae5eb9b593ba646c74c043f3298339500ae6e9991c6ddda3d107

757f2c62637765cbc8c7b9f5f63ed4ab00f34485f516a66b2a81b4edfb731920

79175b288ec1c3ce39c6bdde80cd4f161e5827c9fdbe38c56d7c1e17190d3031

78602029c405408c88448c39440c683d98dff3927819018ef9b7733a5ceb5da0

73110adcd240b43cf9ff0d9e5fcc4bb4bcf6aa0fa02305fced52ca6056e6a8fe

6ea585b9e8243929d4cbe1e2a5e1bd5d27e7025e07cb88fe6dfa26e24db75a1b

756eb52d350b26a0cf1fbf4211b308f5b8dcf51de97384bbd3efa2549f200837

74b4a1409e686d9b8743ba282776b5498084cd4cecc1e10f1d2fde3ee5f3f401

472

8af08a5874b1c07b9e0439c6c6b245c5dfe0165d74b8d6e8418c81a495d20fa4

8ae68b8861c6a995d602f3ce963c3a494b464fed4ca218aca49d05933d7e800e

8d879119658a62a5348a5a99d651c9226a22ed6dfc998e3a6f5a89365738e4fd

8af858767b555f73b9be7c0a0a05a8908831517ec96ca81dac0477350e8412d9

7d528e00c14cd0ec65cbb5c037a0d82534012fd0fb69e7ec87f74b3badea2dba

7bd6791872fae01c542caff4b157ad1af8a3e5db0232af58a64be950b8fc64bd

89957e5645eff61bc0dbf1a81307a177cc257d301a5635e5a4bf3c835eca36f3

88eb9141c5286863edf5485e6ab061d8732823be50620f8b2b515736c1018fdd

b4c0ca382099bdf46583a8c2cb319772d37c02158e42246da87f7f03dfc610cc

b392f2d4ca451b9b125219b6b4f17d491b76e5dc464cfe47f4963ba356db961f

bb1924fa04011ae066a4c37a2816f72079aee10fd64a18b9d5e2ed86dead41a7

b693cbb85767639b9498658aec21d60be62796ffe55d44206674d4215f212e0b

b1a705cc5dadd4aece01bedec08657b96398d09e610d99cd14f0896825d70d09

b0a63a52c1fe355e9f6a9b8510918148ddd4b0b3f428f41efd791bcc9591de37

b25bf134ae6aba260b66dfe8c63771c2c7f9ee971e8bdf4a366d7ce7a59ec179

b20984771f38828a83e820177f49ed9bd3c1f7d4e0074c3e98fea8e9b2aee59f

c4113725d446456d2c8297b168ca517c5b4746bff8963ba924845ef2b088e8bc

c35689220aa747892eed9455606aa2025290b0661311b6b95d35790ea8db6974

c79958fceaeecc19afa3cf6771a3e5879410e03feddfe6f78068af1c0556305d

c6cf8aa4cc7f32d053683ac472e19a4202d2f834b56753147a47eebfcca6df5d

bcde0e297f94f4473be6c2710599fbb647a51df7b3a74ddb79004b3c9e3a9988

bb2d57643f90e7612a832c9453f02c6a5c30e6c78c6757230860359c8ee49ab9

bf296c4ea659f60a5588e4e77d653d988ac099bf859674502c8b5d8db1c238f8

bd2835c03ca5ae6a40d07196f0db1a132e6328f4496dad30192ee35197b20070

aa59171b96270032452f8d6655634376ab0fb4d65f709e917a2569a95535e0d7

a9ee2c31cdb61dbeddd498f7ea24af51a8f6d0ee81ebf346996c333626285cdd

aaf89a4594696686191e6930aaacd16c58dea24e6705362361b94d3e81207e56

aaa8d973fe38ffb29a1f901b0e705c225246ef72f95b7d9beb21d10e4e776416

a6f1b5c96f861ca2e98e830d1efff322b1078f2dc26e9ecabd51c83b21f47b90

a3abb006fde836ab57373e1c70ba20439e7a7c30b2958d4c11e1bc9f25f09922

a900edd4b551e2ac1cd599bcc3928b34c072961423ed7cdeecb92de0b7a2b99d

a86e9315d8716667098515716ad24a1468d3173b0a4a4e92402d9e5b0d68ccec

afbc0cd6bcde9e837bcbbb71630859184e3fb9325312d937c72ab8216509e74b

ae3a35bc49909868194237aca4b6edc5b188065dda5372c6c2ddd0a1a424e473

b070c911bfc1e019046c7e5bfee6147285724a63a46e0a3d0623b9e2fb7bc9a6
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afe10e980bb98b3916c63cacd114bebe8d7c5b31957323ab1e06fc91b11d0fc6

abffc9d0499764323d79653befb7806afe169429a16bd48de0c938a24c16f51c

ab9136e1ce9ca49c60a2c2638a316836bd43271417eee640c4701f5610fc53b1

ad1814f5207812b0fc64c66f4535a428c7f818f8af3fabc1fb8ac4edd123dbd1

acbd08888dd94d3fa9e730875880c5130ea6dc0a2bac8711e7877846a68783ea

32792571cc8c425ba87221497f173cff7e39807dd0f9ded92b01be1615d7c49c

3145f0d9ebb497c8a0003d589ca1f6cdcd7ee012a8fa57c5fcb3f42e85b626d3

34f05f3177332221aae694a45f36b685cdd7fd5a37f760c9e925defc2ea0061b

32e76040094ce4892c17fd476e469e08f31d0b298449a779ebec8b02c40aa818

2e3133f2dfdf9c592bee8bef1f303381a36bfc1d7296d9b3c387a544b6daeecb

2e1d9b1624f37d73f7c21e5db10cb3f1e011d03f6463ca03347400e8a55eb3a6

31398e609c7ba646f68de56a301fb0ab437fb5422a63f0f7e6b0f2c1a4606955

30aa7971ca8a4000aaa7d284b102c4a5a3f4cbf734a1e90771e622f065ce3fdb

3d8f3f952786dd25ad89a019ad725a166333d5f11a4ca9a1ea03f43158faa5a7

3ba7666622dbdd39037329ddee346fa850f5a22650ba92717e90f0a24bca0b27

430403239f13cf2367082fbe1969347fb226e45732e7420d89cc4c192f514ded

40ee5ddce83a99d3f9072172e39dff685c4b2ab49f64c429bace120db984c200

3723832d339644f1ea0d331791872c6168c232b2132b3fc1495b1e4404994213

36272f72865f74b7385e9ed79e6f314151c6637f59676fc8baf706752c816f05

37a839bedca315879ba635a97af3f8a2039de97b79ceb8a8213e27d9305ee129

3753fab11eea24eed3dc384c9aae2dc0bd931f2128e91b7b277e63a6dc0f5a7d

1c211064b40aa51849e78008547526286d99357b805a841e3e5027aa7d6aee02

1a279e5017ac83cca03536c6b3c0fad04e0e949dda1d74c7d1258c5e98e9386c

1f2de28a3cdaa3bc55116688fc2019b01e0c034910115c2f41f68540003db78d

1cadf31404272245aa2979d30f627b5407322029d6851b5cdcf5e4d6580eb8ac

16413eb5b6d2a703e05dab91f8bc166ff0e9d95bb548cfbefaef6cfaf9ea7584

1282e5d508ff649a76dd784f665cee595b5a90b5c41058fffd83bfea782ef8a1

19177358a3712e6e04ff62829f1cf2abd638ca2446b9791a37291864b607e9b1

16e9f538cc8d3c9917423deef8bb918338bc9d6583834c35d32113baad9cf953

2aae562f3467ca07004a75489ceb9c4a914cd549bdcf42e3c172ae0e337f6351

2959070db750aede0c90c8fbb5da0558e6a96c2f360414547fd6f8379a744812

2ccef30aa7048da238ae85b8e358db2cdf2a50690c349477f88bcd4701b34671

2b7351c4975b6df7d05baa53eaf0a47ff7ef3d5a8e3884850aa38838ae256413

2039576ef6df56d36dc287fc74a4d352e50376f68909c3f332b782a0cb767d42

1f4e7d11fc15591790d0cf43bf4b8a169829d843af83ddf1e75bc892411113bd
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26146e7be6569d40614720fb829a0601b0e3e53d6af26f3ea60cb4cb28b1945e 22c9a7487e6bf48aabb18fb78764c32241d73cdcade83fdef03451d2579371b1

60ed7ca01be7d563010e5930c51efe005852f3b7a95f32403f3677d29f32b38c

5fdcd073a0e0588e4363cf44115f2d62d900744e27ac12c54a18af28b5c3803f

6618359d4d19997728359453b0598be7562c293ef9d6ac51f2635586096a52bd

634438b9253b789f3b49ff4e437a1ec7960dee685e0eac4cb0dc68cf020cf01a

5b3a8ff94b27ba20933e4850821591f20b6c1bf2d9141bb3870d81b8a457ed83

5aa3ea58895c442d5d9dc019e4743b75da96d6cc2b4c65f9946644af8d0ffe61

5efa03260e92181963f9137b046388978dbb0c4cd85910a33fe6f7eb7cf48628

5db6f84201b56fa441836c88f138893aaa93d302a1574537be9f2bedc75eab35

6cf9956079ff9285df534da801e3ad0e43a37b0813dd9393cf4d5d9deffe60df

6b6a22bce6142c3f55ca94d6e22f20416d20aa3502302986a9e921ca4c686745

6e7b28f76341f9074e49ffe9a88be9c4d2d0ba8c078da85fdb780fef5ce645a0

6df9ea80061403440526a8ea964230a9ea7ce2eda19b23223dc00b9a2b367ae4

696429702b4b4175596863bc3d9d86ea08b0a98c68f84e0264c82c223b4cb179

68e4a9a758cd1a2ae1ee92fe551e701f34dfc4f2979138f79390eeb13698a625

6a502be25b7f6482c2b75d98014402de126eca8b455fe8ca922dd756a7c344c8

6a0b87f77ee8fd51aad3e485958f21353483b78bb718ef08fabd6a7ee9f99bac

49959fe7d6a90c480c86ffd99b3a0bd9e849d30825a317dbb17129440c1a7fd8

4719a64be3539c45a2e4fa36aadd93b6247e0fe8ed06aaef51e7918bddb78748

4c16eea54a6011ab7159b5e418041caf5ccf0193857cc573a110c697ef4413f5

4b4ee0649b719ce5a14b63c9b3a7f7bc0878b530ad158f9c2a04c3dd8b015af4

447c2096ea44149f4428ffd688ff2d812cb976a57ea018455a17d4eb7b0727b5

4334940b8b20457a8202407c1afcfad89fe207a58d9e4df431c164b1b9513864

4706f444c6fa954431a345f9008205091ece3603f84ae67b2b0b745e21529f96

45a31a34dd3069de30f6ce77ebae0a5756613fa50bf2d1add8bef089e0e1e9b4

5905e6c3fa0157d6178504b1a258b659c22e2d2d6c868f95dd25370d01e5902d

577276e06dc5f5ad64003ee100179b69e7b8bfda145e2fa314e04feae264933e

59aa46ee3b1593b86dc8cf2c95d63d3a61167c95de664c800c6ebb86a3a476f2

5910cb0c3dee7c74728eb955000a2c1b300898ff3358d689bfaa6cd5e9231c19

4f8531775aef24138b54c6f416dfd19fb8b7e0be32ba200972a833da1f17fe1b

4dea51cf62546adf2ed17b0b058888d42d8df93d6cf2682cae20352db1e61236

5101b352d1d09de8d0dcbfc977fa5a486cb173f2d327451ba50c6280ac7a9c37

4fa5ba282f37f16f1326cec81d1a7d474921b4160ae618e08a1195b8ea6f07a7

Dots dots dots.
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snowyowl@jpnsec[.]com -

hxxp://applyinfo[.]org - [9]DarkHotel Cyber Espionage related email.

hxxp://anteph[.]org - [10]PushDo malware campaign affiliated email hxxp://darkhero[.]org - [11]Threat Group 3390 Cyber Espionage related email hxxp://googmail[.]org - [12]Uyghur Targeted Malware campaign related email hxxp://update-onlines[.]org - [13]Threat Group 3390 Cyber Espionage related email Sample photos include:

[14]

[15]

[16]
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Sample screenshots include:

[17]
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[18]

478





[19]

[20]

[21]
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[22]

480





[23]
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[24]

Stay tuned!

1. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiEKqY4PXMDfChs2plo8_Y2CfWJYzHDRaQCKxoSA7pehN__v

GQbaZLQ-JPZldihbATqJqw-FGaVnwCmFGJCd2P_MHIleNu2v9s5hYm

2. https://ddanchev.blogspot.com/2023/04/profiling-internet-connected.html

3. https://www.forcepoint.com/blog/x-labs/uncovering-malicious-traffic-direction-system-blackhat-tds

4. https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/08070901/darkhotelappendixindica

tors_kl.pdf

5. https://malwarebreakdown.wordpress.com/2016/11/01/pushdo-checkin-traffic-update/

6. https://www.secureworks.com/research/threat-group-3390-targets-organizations-for-cyberespionage

7. https://securelist.com/cyber-attacks-against-uyghur-mac-os-x-users-intensify/64259/

8. https://www.secureworks.com/research/threat-group-3390-targets-organizations-for-cyberespionage

9. https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/08070901/darkhotelappendixindica

tors_kl.pdf

10. https://malwarebreakdown.wordpress.com/2016/11/01/pushdo-checkin-traffic-update/

11. https://www.secureworks.com/research/threat-group-3390-targets-organizations-for-cyberespionage

12. https://securelist.com/cyber-attacks-against-uyghur-mac-os-x-users-intensify/64259/

13. https://www.secureworks.com/research/threat-group-3390-targets-organizations-for-cyberespionage
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14. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjuWXFk8sj-A0VF9sulANZt-JGLXqnI_KAWrLkpm_9G4VZ

50pfWseaFcpsTKnb0lgjaTNW8--_wADf789PlRP1UOH8Evc1YS2EYC2w

15.

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhPhEcz8hP420Uofe80TlxsYyd8t6BfAiDIAWI39X7uPAG

BC2DxX1e7IHcEIefzsP7KU-YLOmHr9mN9uLxKe2lvl3ba4b4cjyHkDrJ

16.

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi0j-fgE_XifZrz9rV4m59WuGLkZGzKDU_pkDQDLhTy5If

10bgFJOzrrH6boTI1hHf3sp_BJikY5mljqKwa0w3Zp32dhtjMCfErWT2

17.

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiMkbOrZhS_M96rb2-ROvbjn6x1xCaa2XM1NYL64dOowdO

Vb7XYeIzI5d6pWSuBgb_uhpn6v6e_hXAbJmTUnrfYqYJ6wnmPQRogyaU

18. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEifeiRo_9-r-UKalEA9jiorb9pGEQEio1nGgqabc20mIfw

zNklKx1TdFVHs5exPal7rXpBR1_OqpzoqpQK1iZvHyk4hXJaOlFXsUoJ

19.

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjgLSvpfZj7rZ9MFZAQ05p_yBXC0si2oRsHAdTQgSmZ1yX

-HvHgZW07phAtWqaOXRpvei6BY4TxBDYPy4h2PSv8HxdnMCyWOv2YgmL

20. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEif81kAqaSMok6FCQg7INbXHWN6xt-HFpwnVKjKmwpUUzs

Xj-uHZjijW3eYcs7YZnCVBRrbM12QmyOKcoVjUO-H4vfDi2bCsklEabT

21. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgn8l1DnWIe5-uSaKhb9mxs0RcbZuWxNEcd9Kw6nHtrFZL

G_c_Kw82X48XshMy1ciGvon7ptyJnDkv_XFNFhXSdWKrcMNDzeDyBvgd

22. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjJ2OdvXo-0zZKbD7iVSAuvWqH0zS2qU37uZP52N5Hy-H5

bjH4mJtwMB9072H6TDiz3yfqXpBggjWqBk_mpW3e19piEF_s3XMLw0nn

23.

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgmKWG6FWktJBV0YoPysXq6oUVtyNmvJIfUeKZjLC32dpd

D1zVlPc4TXSJv5cdamhLuyiOp58fmigUD3wH8nnFWkQ5-K7YxbsBRLwr

24.

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjB6Mny3z8jK1A1cpdgkW9L0vic9lofQI7DUTudCQEvM92

yKiaE-SpjXMDHgCbQDVUSM-jOyE6Am2BuBm_44izcC8tgeJKUW978tQN

1.2.6 I’m Back - Part Two (2023-04-13 20:54)

[1]

Jesus. Jesus or Cyber Jessus or it’s just a mentality?
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If you can figure out what’s happening here you’ve probably figured out that this is me circa 2010 trying to get "back to basics" online which in the context of meaning really means hard work a lot of socializing and distributing as much thoughts and random notes including hard-work driven research as possible to my fellow readers who greatly inspired me to continue blogging and doing research on my personal blog including the usual volume of traffic that I get here from friends and colleagues from the industry including the U.S Intelligence Community and U.S Law Enforcement where it’s my pleasure and an honor to communicate my findings and research in my area of expertise to my readers and friends on a daily basis.

[2]

If a link is worth a thousand words try the following U.S Secret Server most wanted cybercriminal which guess what with no laughing here is [3]AbdAllah one of my favorite Russian Business Network affiliates circa "back in the time".

[4]
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Who wants to really help me fund my retirement fund is into collectables and memorabilia understands my "big picture" including the "big picture" and has BitCoin and wants to give me a hand here in exchange for something really personal which is my personal 20TB personal archive files from 2010 when I was on the top of my being popular game up to 2023 present day where I’m struggling with paying the bills working on part time OSINT projects? Keep reading.

Did you know that if you’re a U.S Intelligence Community member doing cyber intelligence and possible research and stumble upon a "4PXFIL" or "E9BDJ4PXFIL" marking in terms of an email address account there’s a high probability that this is me and several other [5]online individuals doing "outsourcing SIGINT" also known as "fourth party exfil" for further campaign attribution and actually bothering to publicly "connect the dots" on major and high profile cyber attack campaigns where I was proud to participate in a [6]Top Secret GCHQ Program known as

"[7]Lovely Horse" to monitor hackers online and on Twitter for technological know-how possible labeling them as

[8]
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By the way for the record in case you still haven’t reached the online dazzlement stage check out the following screenshot and stay tuned for the actual details. The best is yet to come.

1. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhra5mhU0Sh8PQN4fl7LoOs8x7tmb5YXx1rwyq6NEiclkl0c

acMFAU-ctvzsRwyHQRGPIPNSvB1AT5F7dczBkgSafPFgj9AkwzPjWt

2. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiO-zWh-UY2yWpU1NGEJ1gmF501V4xnxm1DBiuXRE1BB_rzM

ZSks_dhUFZYQ2Wp3XdNuJzty0kllCoRCE2D5Is0s-lwLZT41me4FA4

3. https://www.secretservice.gov/investigation/mostwanted/rytikov

4. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgUNsOVA6xtxhXSba3c-DqN5i7QWfx3vyggXHqwJw-NePnUC

gkzYDbasCeOstjVQQvPBn_VmTv1BpVT__CFw9vIknXDErWgMVAhpzE

5. https://www.forbes.com/sites/firewall/2010/08/06/bbhc-global-and-project-vigilant-wheres-the-money/

6. https://cryptome.org/2015/02/gchq-lovely-horse-intercept-15-0204.pdf

7. https://s3.documentcloud.org/documents/1588694/who-else-is-targeting-your-target-collecting.pdf

8. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjnTv1a8MLAceJFpfdj8SiApa_0Ab0NoHU6-b9xvuU2GebOO
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U9EVTpyzmaCqnJLUyBVc3oANyO8RiOfewkjJH_0RLYm-owg8emPg4z

1.2.7 Auctioning Off? Think Twice and Show Your Support! (2023-04-24 18:12) Surprise, surprise.

Guess who’s selling out without being a sellout?

[1]
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Although many of you know and remember me from 2010-2013 with my research when I was on the top of my research and analysis game today’s harsh reality is that I think that I’m that very close to retiring and basically finding another venture to pursue possibly something in the lines of corporate cyber security investment portfolio and innovation management where I can be of great help where I’m currently busy paying the bills including a loan including to work on part time OSINT projects with great success where my primary goal would be to secure a financial pension and retirement fund in the context of auctioning off my 20TB personal files archive dating back to 2010 and 2023 for collectibles and memorabilia purposes where among my primarily long term projects would be to launch a training program in my line of work including to write a Second Edition of my personal memoir including to write several upcoming books.

Stay tuned!

1. https://blogger.googleusercontent.com/img/a/AVvXsEgpv7vG54wRlJ9jE5SCtEmE2eTRGFR_cVrkkQ7VcUK1Drw1FzLRaUyXq-
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jZmNjDXP9eRqCvhn8FBKpnVuovGhNBcR9h1z7g5vJog57tM6dgEk8r

1.2.8 Who Has Information on the Bad Guys and Wants to Share it with Me?

(2023-04-24 19:23)

[1]

Dear blog readers,

As of today I’m starting to do something that I haven’t really done in ages and probably never really did throughout my entire career which is to do my best to assist friends and colleagues including the appropriate Law Enforcement parties with research and knowledge on the bad guys which in this particular case would be to solicit information from my readers on current and emerging cyber threat actors from my readers using a Dark Web Onion which in this particular case is:

[2]http://3axk7cmmrvz5ynggt5of2qp5i7ifhfimlnavv23ymm7en7ogjxe57jyd.onion Here’s what I’m looking for:

• anything related to cyber intelligence in terms of currently active and ongoing campaigns including all the associated IoCs that you can share and that you think I need to go through and work on based on your submission such as for instance raw cyber intelligence details on current and ongoing campaigns domains personally identifiable emails MD5s including anything that you think and believe might be worth working on in terms of what you’re sharing in terms of "processing" and enriching and working on reaching out to the appropriate parties including the proper Law Enforcement parties involved in tracking down and prosecuting the cyber criminals behind these campaigns
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• personally identifiable information on the bad guys which I’ll do my best to share with the appropriate Law Enforcement party including friends and colleagues who can truly make an impact to track down and prosecute the bad guys based on their campaign activity Here’s what to expect in exchange:

• always make sure to know that I’ll go through all the cyber intelligence IoCs personally identifiable information on the bad guys malware and exploits serving domains and associated MD5s including anything related to my line of work personally and will work to enrich and "process" your submission with the utmost professionalism as possible and as always.

Stay tuned!

1. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjGSfINfiLB7a14NkplrfcHP5nKQLLZ8uMprEUexzMd4lJ0X

pxFfLGm9xxn7MDX4KICgk35hU-YqnRaJytO5EBiP_iDY8vOQ5s7dAy

2. http://3axk7cmmrvz5ynggt5of2qp5i7ifhfimlnavv23ymm7en7ogjxe57jyd.onion/

1.2.9 Happy Holidays From The (Not) Republic of Bulgaria - An Analysis - Part Four (2023-04-24 19:24)

[1]

[2]

[3]Dipshit.

1. https://linkedin.com/in/yavorkolev

2. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg8DnfvA7NVIgW9BDgrgItOAoAYYxUgNJso5GlQsWSEv2XCQ

yAuEbOnq-1q0jJt8RZemf3S08c2uKvNLefIR8P6gRVSPY-KYLLSfxV

3. https://linkedin.com/in/yavorkolev
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1.2.10 Upcoming DVD Training and Educational Research Compilation Release (2023-04-27 14:49)

[1]

I wanted to let everyone know that I’m going in deep research mode which means approximately countless days of recording what appears to be my first DVD compilation in the context of reaching out to my readers and sharing my true story circa the 90’s up to present day where I’ll do my best to record my idea as soon as possible and publish it [2]here.

Sample screenshots include:

[3]
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[4]
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[5]
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1. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgkHaEPxuZX4QA3PFnrsOMhIImoGoBr3iwLe4Rip5kSw8aHr

-TSon8pT1MbtOFtWreRFgRqJ1avw-xCiFz2dznI7b3FRyyZzHygmB9

2. https://archive.org/details/@ddanchev

3. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEifNAe_mOLR9MThIz4ZI226o0gs1g09Vh63egR_zEoPos9TT

7fcMrAbE_SchM90IsXIHUvhMRinU1-yfSPeey82VS9P1XUBZtwuRyW

4. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg_I1wrbC5ZDwQb_CKUBfCKYNvaVwvGCs2U2fAUwQ6w0dVbR

CUDoZgfUJNKvYyGwadsoj6AsTBm3zhucWURtgsm6kKOOyT5ff5eV3J

5. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg4utBOCSLgwnQRUL6lDaY5j0sqs9t0bY9thpdjgY-ez_EDH

A4ed1xoB9ZZTPD-2zGLmZBM0qQmKuFq3y4wzccY46zR_PDfHkRZvyN

1.2.11 My Memoir - In Bulgarian (2023-04-27 14:49)

[1]
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Did you know that I have a [2]memoir [PDF] written in Bulgarian? Did you also known that I have a two hours long free [3]audio book [MP3] in Bulgarian? Did you also know that you can also freely download my memoir in Bulgarian in various [4]E-Book [ePub] format readers for free?

1. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiZN9P_H2fnJcOJFyVWnTeMIIt1x6EzYHGtATRTtxSrTJ-tQ

mCL47LQdN74qbwYnsqiK3YC30ose5lkZMT6OH6JlGoNqYfrVvRnMA1

2.

https://archive.org/download/dancho-danchev-kiber-razuznavane-audio-kniga-01-memoar/Dancho_Danchev_Kiber

_Razuznavane_Memoar_02.pdf

3.

https://archive.org/download/dancho-danchev-kiber-razuznavane-audio-kniga-01-memoar/Dancho_Danchev_Kiber

_Razuznavane_Audio_Kniga_01.mp3

4. https://archive.org/details/dancho-danchev-kiber-razuznavane-audio-kniga-01-memoar
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1.2.12 Who

Needs

or

Wants

OSINT

and

Threat

Intelligence

Training?

(2023-04-27 14:50)

[1]

If anyone’s interested in advanced online OSINT and advanced online cyber threat actor profiling and threat intelligence training both individually or in group feel free to drop me a line at dancho.danchev@hush.com to discuss.

This is the primary Table of Contents for the advanced OSINT training which I can offer:

• Introduction

• Who is Dancho Danchev?

• What are some of my current and future projects?

• Basics of OSINT

• Current State of the Cybercrime Ecosystem

• Novice OSINT Tactics

• Advanced OSINT Tactics

• Fighting Cybercrime in the Context of Using OSINT

• Threat Intelligence Gathering in the Context of Using OSINT

• Technical Collection in the Context of Using OSINT

• Cyber Attack Attribution in the Context of Using OSINT

• Threat Intelligence Enrichment in the Context of Using OSINT

• Cybercrime Research and Enrichment in the Context of Using OSINT

• Practical OSINT Advices

• Case Study on Fighting Cybercrime Using OSINT

• Case Study

• First Case Study

• Second Case Study

• Third Case Study

• Fourth Case Study

• Fifth Case Study

• Conclusion
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This is the primary Table of Contents for the advanced threat intelligence training:

• Introduction

• Overview

• Threat Intelligence Methodologies

• Proactive Threat Intelligence Methodologies

• The Future of Threat Intelligence

• Basics of Threat Intelligence

• Current State of the Threat Intelligence Marketplace

• Current State of the Threat Intelligence Ecosystem

• Novice Threat Intelligence Concepts

• Advanced Threat Intelligence Concepts

• Fighting Cybercrime in the Context of Using Threat Intelligence

• Using OSINT in the Context of Threat Intelligence Gathering

• Threat Intelligence in the Context of Using Technical Collection for Cyber Threat Actor Attribution Attacks

• Threat Intelligence in the Context of Cyber Attack. Attribution

• Threat Intelligence Enrichment in the Context of Using OSINT

• Cybercrime Research and Threat Intelligence IoC (Indicator of Compromise) Enrichment in the Context of Using OSINT

• Practical Threat Intelligence Advices

• Case Study on Fighting Cybercrime Using Threat Intelligence

• Case Study

• First Case Study - The Basics of Starting Into Threat Intelligence for Beginners - A Practical Case Study

• Second Case Study - Advanced Threat Intelligence Practices Concepts and Methodologies

- A Practical Case Study

• Third Case Study - Does the "Aggregate and Forget" Methodology Really Work in the Field of Threat Intelligence? - A Practical Case Study

• Fourth Case Study - The Basics of Launching and Maintaining and Operating a Company Wide Threat Intelligence Program for Beginners - A Practical Case Study

• Fifth Case Study - Advanced Operation and Maintaining of a Company Wide Threat Intelligence Program for Advanced Users - A Practical Case Study
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• Sixth Case Study - How to Train Your Threat Intelligence Analysts to be Security Industry’s and Analytical and Technical Rock Stars? - A Practical Case Study

• Seventh Case Study - How to Convert Your Company Employee Endpoints Into a Distributed Threat Intelligence Passive and Active Threat Intelligence Gathering Sensor? -

A Practical Case Study

• Eight Case Study - How To Convert Your Clients Into a Passive and Active Distributed Threat Intelligence Gathering Sensors? - A Practical Case Study

• Ninth Case Study - How to Utilize Public and Proprietary Threat Intelligence Databases for Cyber Threat Actor Attribution Campaigns Including Cross Reference and Cross Checking of

• Tenth Case Study - How to Enrich Your Company Wide IoCs (Indicators of Compromise) Using Public and Proprietary Sources and Connect the Dots on a Major Cyber Attack and Cyber Threat Actor Campaign

• Conclusion

And here’s a sample introduction for the OSINT training which I can offer with the idea to get you to know the actual style of the training:

Basics of OSINT in the Context of Fighting Cybercrime - The Definite Beginner’s Guide

“What use are they? They’ve got over 40,000 people over there reading newspapers. ” - President Nixon

This introductory guide into the world of OSINT is part of an upcoming series of articles aiming to assist both novice and experienced security practitioners including analysts for the purpose of entering the world of OSINT for cybercrime research and aims to offer a high-profile and never-published before practical and relevant in today’s nation-state and rogue cyber adversaries Internet and cybercrime ecosystem whose purpose general overview and introductory material and training course material for novice beginners including advanced Internet users hackers security consultants analysts including researchers who are interested in exploring the world of OSINT (Open Source Intelligence) for the purpose of making a difference doing their work in a better and more efficient way including to actually be fully capable and equipped to catch the bad guys online including to monitor and track them down to the point of building the big picture of their fraudulent and rogue online activities. The course including the actual learning and training material is courtesy of Dancho Danchev who is considered one of the most popular security bloggers threat intelligence analysts and cybercrime researchers internationally and within the security industry.

The primary purpose behind this guide is to summarize Dancho Danchev’s over a decade of active passive and active including actionable threat intelligence and OSINT research type of experience including cybercrime research type of experience where the ultimate goal would be to empower the student or the organization taking this course into better doing their online research work including to be fully capable of tracking down and monitoring the rogue and malicious online activities of the bad guys online where the ultimate goal would be to better position and enhance your cyber attack or malicious threat actor cyber campaign attribution skills ultimately improving your work activities and actually empowering you to learn how to do OSINT for good and most importantly to track down and monitor the bad guys.





Introduction


498


In a world dominated by sophisticated cybercrime gangs and nation-state sponsored and toler-ated rogue cyber actors the use of OSINT (Open Source Intelligence) is crucial for building the big picture in the context of fighting cybercrime internationally including to actually "connect the dots" in the context of providing personally identifiable information to a closed-group and invite-only LE community including international Intelligence Agencies on their way to track down and prosecute the cybercriminals behind these campaigns.

In this training and learning material Dancho Danchev one of the security industry’s most popular and high-value security blogger and cybercrime researcher will offer an in-depth peek inside the world of OSINT in the context of fighting cybercrime and will provide practical advice examples and case in particular on how he tracked down and shut down the infamous Koobface botnet and continued to supply never-published and released before potentially sensitive and classified information on new cyber threat actors which he continued to publish at his Dancho Danchev’s blog.

Basics of OSINT

OSINT in the context of fighting cybercrime can be best described as the systematic and persistent use of public information for the purpose of building a cyber threat intelligence enriched data sets and intelligence databases both for real-time situational awareness and historical OSINT preservation purposes which also include to actually "connect the dots" in cybercrime gang and rogue cyber actor campaigns and cyber attack type of campaigns. A general example would consist of obtaining a single malicious software sample and using it on a public sandbox to further map the infrastructure of the cybercriminal behind it potentially exposing the big picture behind the campaign and connecting the dots behind their infrastructure which would lead to a multi-tude and variety of personally identifiable information getting exposed which could help build a proprietary cybercrime gang activity database and actually assist LE

in tracking down the prosecuting the cybercriminals behind these campaigns.

"There’s no such thing as new cyber threat actors. It’s just new players adopting economic and marketing concepts to steal money and cause havoc online."

The primary idea here is to locate free and public online repositories of malicious software and to actually obtain a sample which will be later on used in a public sandbox for the purpose of mapping the Internet-connected infrastructure of the cybercrime gang in question including to actually elabore more on the ways they attempt to monetize the access to the compromised host including possibly ways in which they make money including to actually find out what exactly are they trying to compromise. Possible examples here include VirusTotal or actually running a malware interception honeypot such as for instance a spam trap which would allow you to intercept currently circulating in the wild malare campaigns that propagate using email and actually analyze them in terms of connecting the dots exposing their Internet-connected infrastructure and establishing the foundations for a successful career into the world of malicious software analysis and cybercrime research.

"Everything that can be seen is already there".

The next logical step would be to properly assess and analyze the recently obtained sample and to properly establish the foundation of a "connect the dots" culture within your organization where the primary goal would be to have researchers and analysts look for clues on their way to track down and monitor a specific campaign potentially coming up with new and novel cyber attack attribution research. Visualization is often the key to everything in terms of visualizing threats and looking for additional clues and possible cyber attack attribution clues where a popular visualization and threat analysis tool known as Maltego should come into play which basically offers an advanced and sophisticated way to process OSINT and cybercrime research 499

and threat intelligence type of information and actually enrich it using public and proprietary sources of information for the purpose of establishing the big picture and actually connecting the dots for a specific cyber attack campaign.

Among the first things that you should consider before beginning your career in the World of OSINT is that everything that you need to know about a specific online event a specific online campaign that also includes the activities of the bad guys online is already out there in the form of publicly accessible information which should be only processed and enriched to the point where the big picture for a specific event or a malicious online campaign should be established using both qualitative and quantitative methodologies that also includes the process of obtaining access to the actual technical details and information behind a specific online event or an actual malicious and rogue online campaign.

Among the few key things to keep in mind when doing OSINT including actual OSINT for cyber attack and cyber campaign attack attribution is the fact that in 99 % of the cases all the collection information that you need in terms of a specific case is already publicly known and is publicly accessible instead of having to obtain access to a private or a proprietary source of information and the only thing that you would have to do to obtain access to it is to use the World’s most popular search engine in terms of collection processing and enrichment.

The second most popular thing to keep in mind when doing OSINT is that you don’t need to obtain access to proprietary even public OSINT tools.

Current State of the Cybercrime Ecosystem

In 2021 a huge number of the threats facing the security industry including vendors and organizations online include RATs (Remote Access Tools) malicious software part of a larger bother malicious and fraudulent spam and phishing emails including client-side exploits and vulnerabilities which have the potential to exploit an organization or a vendor’s end points for the purpose of dropping malware on the affected host including the rise of the ransomware threat which is basically an old fashioned academic concept known as cryptoviral extortion.

With more novice cybercriminals joining the underground ecosystem market segment largely driven by a set of newly emerged affiliate based revenue sharing fraudulent and malicious networks offering financial incentive for participation in a fraudulent scheme it shouldn’t be surprising that more people are actually joining the cybercrime ecosystem potentially causing widespread damage and havoc online.

With cybercrime friendly forums continuing to proliferate it should be clearly evident that more people will eventually join these marketplaces potentially looking for new market segment propositions to take advantage of for the purpose of joining the cybercrime ecosystem and that more vendors will eventually continue to occupy and launch new underground forum market propositions for the purpose of promoting and looking for new clients for the services.

In a World dominated by a geopolitically relevant Internet cybercrime ecosystem it shouldn’t be surprising that more international cybercrime gangs will eventually continue to launch new fraudulent and malicious spam and phishing campaigns that also includes malicious software campaigns for the purpose of earning fraudulent revenue.

With more affiliate based underground market segment based networks aiming to attract new uses where they would forward the risk for the actual infection process and fraudulent transaction to the actual user in exchange for offering access to sophisticated bulletproof infrastructure including advanced and sophisticated malware and ransomware releases it shouldn’t be surprising that more people are actually joining these affiliate networks for the purpose of earning fraudulent revenue in the process of causing havoc and widespread disruption online.
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In this brief Basics of OSINT in the context of fighting cybercrime article we provided a general overview of the process of using OSINT for cybercrime fighting purposes and we hope that you enjoyed the article and will be eager to go through the second part of the article series which will be published at our Web site in the coming weeks.

Sample screenshots include:

[2]

[3]

1. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhuB_dhzFu6p4EEsGN2BaIBbgQPFdEzCdVJkPlktrHgPY6QA

JQUvybV9-Jl9A26WVXqyKhBzttZbnbgMkaQ1fywcsYhZY_kxtL2g5B

2. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEixYeeytIDyWh-x6BIrtSYH0TtiO-FiKY3_keJq_ApIkriJr

kNMp6yCOKuGV7u0KJ48TryVq1a2A_z0QTbw9E6DAUzji6gFhal5HDE

3. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh8vTebE-WzeBQZuo0kpo0kRWL4qZ5nb-ucuNOOK85J1yRrQ

O513PPX_1xd3PHc4HXM73WNP9vjVeQozK1L-VpocdY2tLfYIwD7xcP
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1.2.13 Today’s Compilation of Botnet’s C&C Panels (2023-04-28 14:31)

[1]

I decided to share with everyone a currently active set of botnet C &C panels which I obtained using OSINT and public sources which are currently active in the time of posting this with the idea to raise more awareness on their existence and potentially prompt you to go deeper in terms of research and tracking down the cybercriminals behind these campaigns.

Known responding IPs:

190[.]123[.]44[.]145

37[.]139[.]129[.]69

79[.]137[.]203[.]19

179[.]43[.]142[.]172

31[.]41[.]244[.]146

Sample C &C Panels:

hxxp://sertvs[.]com/8vcWxwwx3/index[.]php

hxxp://specialblue[.]in/dF30Hn4m/index[.]php
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hxxp://79[.]137[.]203[.]19/6nd8ssa3/Login[.]php

hxxp://179[.]43[.]142[.]172:443/admin/console/

hxxp://31[.]41[.]244[.]146/u83mfdS2/Login[.]php

1. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgFi0yztd5vhfAvhLaj1RFJoHdndVCWS7TGWifh5H0O6I0WU

BSDQW_KnwnBQyqknL0jKoDcWu9W43MAFF5gcdYwdY48D6LHuXa4RHA

1.2.14 A Compilation of Koobface Botnet Themed Malicious Executable Download Locations 2009 - 2011 (2023-04-28 14:31)

[1]

While digging into my old threat intelligence research archive I found the following which I decided to share with everyone.

Happy "takes you back doesn’t it" time and OSINT and threat intelligence for historical cross-checking and connecting the dots time.

Sample URLs include:

hxxp://quwudgwddcjbsjdwdjwopdwojdjjjjjjw[.]com/?getexe=tumlike[.]2[ .]exe hxxp://selectionmusic[.]co[.]za/[.]sys[.]php?getexe=poster [.]10[.]exe 503

hxxp://selectionmusic[.]co[.]za/[.]sys[.]php?getexe=fri endfeedreg[.]1[.]exe hxxp://selectionmusic[.]co[.]za/[.]sys[.]php?getexe=aolsbm[ .]2[.]exe hxxp://selectionmusic[.]co[.]za/[.]sys[.]php?getexe=twreg[. ]12[.]exe hxxp://selectionmusic[.]co[.]za/[.]sys[.]php?getexe=tumreg [.]1[.]exe hxxp://roomservicedesign[.]com[.]au/[.]9mov05w/?getexe=drk[.] exe

hxxp://roomservicedesign[.]com[.]au/[.]9mov05w/?getexe=ffe32[. ]exe hxxp://roomservicedesign[.]com[.]au/[.]9mov05w/?getexe=y ahblog[.]exe hxxp://mdcoc[.]net/jxjv0z2s/setup798342[.]exe

hxxp://www[.]blowmeupbig[.]com/[.]iunb8/?getexe=za[.]exe

hxxp://www[.]blowmeupbig[.]com/[.]iunb8/?getexe=hny32[.]exe

hxxp://www[.]chateaudecoisse[.]com/[.]tfdmezb/?getexe=m24[.]i n[.]exe hxxp://www[.]chateaudecoisse[.]com/[.]tfdmezb/?getexe=dg[.] exe

hxxp://anlaegkp[.]dk/trygxqlz/setup314555[.]exe

hxxp://lyulf[.]co[.]uk/2pmf1qq/setup742472[.]exe

hxxp://careyadkinsdesign[.]com/[.]uzb62/?getexe=ff2ie[.]exe

hxxp://careyadkinsdesign[.]com/[.]uzb62/?getexe=p[.]exe

hxxp://careyadkinsdesign[.]com/[.]uzb62/?getexe=m24[.]in[.]ex e

hxxp://careyadkinsdesign[.]com/[.]uzb62/?getexe=dg[.]exe

hxxp://solarinstitut[.]com/yf734/index[.]php?e=635893

hxxp://helpingouryouthachieve[.]com/sim/index[.]php?e=590202

hxxp://www[.]darelorenzo[.]it/[.]sys/?action=fbgen &v=104 &crc=669

hxxp://1zabslwvn538n4i5tcjl[.]com/temp/exe/codec[.]exe

hxxp://smx[.]nu/y580/setup[.]exe

hxxp://mantleofmercy[.]org/07/

hxxp://watvindteindhoven[.]nl/614/?go

hxxp://stagnescathedral[.]org/actualperformans/?72691/

hxxp://partenaires-particuliers[.]fr/[.]abodpg/?getexe=tg[. ]16[.]exe hxxp://viale[.]be/[.]jxel/?getexe=p[.]exe

hxxp://viale[.]be/[.]jxel/?getexe=ws[.]exe

hxxp://cedelevator[.]com/[.]sys/?getexe=tg[.]16[.]exe

hxxp://www[.]person[.]doae[.]go[.]th/[.]sys/?getexe=tg[ .]16[.]exe hxxp://ntas[.]com/[.]sys/?getexe=tg[.]16[.]exe

hxxp://waypoint-center[.]org/[.]sys/?action=ppgen &a=-2001606274 &v=106 &pid=1000

hxxp://waypoint-center[.]org/[.]sys/?action=fbgen &v=106 &crc=669

hxxp://deltasatuk[.]com/[.]sys/?getexe=cmd[.]exe
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hxxp://deltasatuk[.]com/[.]sys/?getexe=hostsgb3[.]exe hxxp://deltasatuk[.]com/[.]sys/?getexe=ws[.]exe

hxxp://formacio[.]eio[.]es/[.]sys/?getexe=hostsgb3[.]exe

hxxp://formacio[.]eio[.]es/[.]sys/?getexe=ws[.]exe

hxxp://grdcb[.]com/[.]sys/?getexe=cmd[.]exe

hxxp://grdcb[.]com/[.]sys/?getexe=hostsgb3[.]exe

hxxp://grdcb[.]com/[.]sys/?getexe=ws[.]exe

hxxp://inartdesigns[.]com/[.]sys/?getexe=hostsgb3[.]exe

hxxp://inartdesigns[.]com/[.]sys/?getexe=ws[.]exe

hxxp://jcshop[.]netfirms[.]com/[.]sys/?getexe=ws[.]exe

hxxp://journalsexyplus[.]com/[.]sys/?getexe=hostsgb3[.]exe

hxxp://journalsexyplus[.]com/[.]sys/?getexe=ws[.]exe

hxxp://littlepalmbeach[.]com/[.]sys/?getexe=cmd[.]exe

hxxp://littlepalmbeach[.]com/[.]sys/?getexe=hostsgb3[.]exe

hxxp://littlepalmbeach[.]com/[.]sys/?getexe=ws[.]exe

hxxp://lotuscovecampground[.]com/[.]sys/?getexe=cmd[.]exe

hxxp://lotuscovecampground[.]com/[.]sys/?getexe=hostsgb3[.]e xe

hxxp://lotuscovecampground[.]com/[.]sys/?getexe=ws[.]exe

hxxp://micaelmarkstrom[.]se/[.]sys/?getexe=cmd[.]exe

hxxp://micaelmarkstrom[.]se/[.]sys/?getexe=hostsgb3[.] exe

hxxp://micaelmarkstrom[.]se/[.]sys/?getexe=ws[.]exe

hxxp://sphusa[.]com/[.]sys/?getexe=cmd[.]exe

hxxp://sphusa[.]com/[.]sys/?getexe=hostsgb3[.]exe

hxxp://sphusa[.]com/[.]sys/?getexe=v2bloggerjs[.]exe

hxxp://sphusa[.]com/[.]sys/?getexe=v2newblogger[.]exe

hxxp://sphusa[.]com/[.]sys/?getexe=ws[.]exe

hxxp://tjsokolosek[.]wz[.]cz/[.]sys/?getexe=loader[.]exe

hxxp://www[.]shogunlevallois[.]com/[.]sys/?getexe=cmd[.]exe

hxxp://www[.]shogunlevallois[.]com/[.]sys/?getexe=hostsgb3[. ]exe

hxxp://www[.]shogunlevallois[.]com/[.]sys/?getexe=ws[.]exe

hxxp://www[.]trattoriabilly[.]com/[.]sys/?getexe=hostsgb3[.] exe

hxxp://www[.]trattoriabilly[.]com/[.]sys/?getexe=ws[.]exe

hxxp://goldmaniac[.]com/[.]sys/?getexe=hostsgb3[.]exe

hxxp://www[.]jwdtrees[.]com/[.]sys/?getexe=hostsgb3[.]exe

hxxp://www[.]jwdtrees[.]com/[.]sys/?getexe=loader[.]exe
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hxxp://www[.]lionkitchen[.]com[.]sg/[.]sys/?getexe=loader[ .]exe hxxp://www[.]shogunlevallois[.]com/[.]sys/?getexe=hosts2[.]ex e

hxxp://www[.]wttcmi[.]com/[.]sys/?getexe=hosts2[.]exe

hxxp://car-transport[.]com[.]au/[.]sys/?getexe=loader[.]exe

hxxp://cooperville[.]be/[.]sys/?getexe=go[.]exe

hxxp://cooperville[.]be/[.]sys/?getexe=loader[.]exe

hxxp://cooperville[.]be/[.]sys/?getexe=pp[.]14[.]exe

hxxp://cooperville[.]be/[.]sys/?getexe=v2bloggerjs[.]exe

hxxp://cooperville[.]be/[.]sys/?getexe=v2captcha21[.]exe

hxxp://cooperville[.]be/[.]sys/?getexe=v2newblogger[.]exe

hxxp://cooperville[.]be/[.]sys/?getexe=v2webserver[.]exe

hxxp://deltasatuk[.]com/[.]sys/?getexe=go[.]exe

hxxp://deltasatuk[.]com/[.]sys/?getexe=loader[.]exe

hxxp://deltasatuk[.]com/[.]sys/?getexe=pp[.]14[.]exe

hxxp://deltasatuk[.]com/[.]sys/?getexe=v2bloggerjs[.]exe

hxxp://deltasatuk[.]com/[.]sys/?getexe=v2captcha21[.]exe

hxxp://deltasatuk[.]com/[.]sys/?getexe=v2newblogger[.]exe

hxxp://deltasatuk[.]com/[.]sys/?getexe=v2webserver[.]exe

hxxp://edensensuel[.]fr/[.]sys/?getexe=go[.]exe

hxxp://edensensuel[.]fr/[.]sys/?getexe=loader[.]exe

hxxp://edensensuel[.]fr/[.]sys/?getexe=pp[.]14[.]exe

hxxp://edensensuel[.]fr/[.]sys/?getexe=v2bloggerjs[.]exe

hxxp://edensensuel[.]fr/[.]sys/?getexe=v2captcha21[.]exe

hxxp://edensensuel[.]fr/[.]sys/?getexe=v2googlecheck[.]exe

hxxp://edensensuel[.]fr/[.]sys/?getexe=v2newblogger[.]exe

hxxp://edensensuel[.]fr/[.]sys/?getexe=v2webserver[.]e xe

hxxp://ertrafikskola[.]se/[.]sys/?getexe=go[.]exe

hxxp://ertrafikskola[.]se/[.]sys/?getexe=hosts2[.]exe

hxxp://ertrafikskola[.]se/[.]sys/?getexe=loader[.]exe

hxxp://ertrafikskola[.]se/[.]sys/?getexe=p[.]exe

hxxp://ertrafikskola[.]se/[.]sys/?getexe=pp[.]14[.]exe

hxxp://ertrafikskola[.]se/[.]sys/?getexe=v2webserver[.]exe

hxxp://formacio[.]eio[.]es/[.]sys/?getexe=go[.]exe

hxxp://formacio[.]eio[.]es/[.]sys/?getexe=hosts2[.]exe

hxxp://formacio[.]eio[.]es/[.]sys/?getexe=pp[.]14[.]exe
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hxxp://formacio[.]eio[.]es/[.]sys/?getexe=v2bloggerjs[.]e xe hxxp://formacio[.]eio[.]es/[.]sys/?getexe=v2captcha21[.]exe

hxxp://formacio[.]eio[.]es/[.]sys/?getexe=v2newblogger[.]exe

hxxp://formacio[.]eio[.]es/[.]sys/?getexe=v2webserver[.]exe

hxxp://goldenliontech[.]com/[.]sys/?getexe=loader[.]exe

hxxp://grdcb[.]com/[.]sys/?getexe=go[.]exe

hxxp://grdcb[.]com/[.]sys/?getexe=hosts2[.]exe

hxxp://grdcb[.]com/[.]sys/?getexe=p[.]exe

hxxp://grdcb[.]com/[.]sys/?getexe=v2bloggerjs[.]exe

hxxp://grdcb[.]com/[.]sys/?getexe=v2captcha21[.]exe

hxxp://grdcb[.]com/[.]sys/?getexe=v2webserver[.]exe

hxxp://jcshop[.]netfirms[.]com/[.]sys/?getexe=go[.]exe

hxxp://jcshop[.]netfirms[.]com/[.]sys/?getexe=loader[.]exe

hxxp://jcshop[.]netfirms[.]com/[.]sys/?getexe=pp[.]14[.]e xe

hxxp://jcshop[.]netfirms[.]com/[.]sys/?getexe=v2bloggerjs[.] exe

hxxp://jcshop[.]netfirms[.]com/[.]sys/?getexe=v2captcha21[.]e xe

hxxp://jcshop[.]netfirms[.]com/[.]sys/?getexe=v2newblogger[. ]exe

hxxp://jcshop[.]netfirms[.]com/[.]sys/?getexe=v2webserver[.]e xe

hxxp://journalsexyplus[.]com/[.]sys/?getexe=v2bloggerjs[.]exe

hxxp://journalsexyplus[.]com/[.]sys/?getexe=v2captcha21[.]exe

hxxp://journalsexyplus[.]com/[.]sys/?getexe=v2newblogger[.]exe

hxxp://journalsexyplus[.]com/[.]sys/?getexe=v2webserver[.]exe

hxxp://juanfurlan[.]com[.]ar/[.]sys/?getexe=v2captcha21[.]e xe
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1.2.15 How I Got Busted for Loving the U.S in Cyberspace? (2023-04-28 14:32)

[1]

Guess who’s been busy setting them straight in cyberspace? Well that would be unfortunately throughout 2008–2013 when I was most active online making the headlines at unknown places online making my day and inspiring me to track down the Koobface botnet on a daily basis.
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[2]

It used to be quite a privilege when I originally attempted to publish an article which I proposed to one of my homeland’s primary technology magazine HiComm and when I got actually invited to publish a series of articles on a monthly basis. Among the first things which I did back then was to translate my extremely popular document “The Complete Windows Trojans Paper” to Bulgarian which was quite a success and the article got published and accepted which was originally published in the Christmas edition of the magazine. The original story behind my infamous “The Complete Windows Trojans Paper” was a major shift between my understanding and experience within the hacking Scene and the modern security industry where I really wanted and did my best to have a career which leads me to today’s leading expert in the field of cybercrime research and threat intelligence including security blogging and OSINT research and analysis on the bad guys including various international and well known cyber threat actors.

I originally wrote and released my “The Complete Windows Trojans Paper” on my own as part of a major marketing effort to promote my knowledge and expertise in the scene where the ultimate goal was to produce a high-quality and never released publication on the topic and basically make it easier for everyone to understand the ongoing trend that have to do with trojan horses back then where I later on originally published my publication on what used to be among my first independent contractor position at my first employer at the time which 522

was Netherlands-based Frame4 Security Systems where I also did a marketing editorial on the company’s web site and has been supporting and working with the company ever since.

The interesting part back then was that I also got a personal recommendation from the company owner for my university application which at the time was a Netherlands-based university where I had the ambition to relocate with my girlfriend and partner in life at the time which we eventually did with the idea to visit and actually go to study in that country.

While I was in Bulgaria during my teenage hacker years I was busy freelancing as an information security consultant while working with international security portals where I was busy offering advice and practical information security advice and practical solution recommendations including my work with CIO.bg where I once contributed with an article on Cyberterrorism and Cyber Jihad including a series of publications for HiComm.bg where I was running a popular information security rubric and participated with several articles in several of the magazine’s issues.

At a later stage I somehow decided to go corporate an in a way find a way to enter the commercial information security industry with my knowledge potentially beginning to contribute with knowledge and information using my personal contacts at various information security portals on my way to land a possible job preferably as a writer security blogger or a journalist which I apparently succeeded in doing as I’ve been actively contributing with my own research and knowledge on a variety of h/c/p/a (Hacking/Cracking/Phreaking/Anarchy) portals at the time. At some point in time Dancho decide to approach the primary operator of one of his favorite security Web sites at the time — https://net-security.org for the purpose of contributing with an article for their newly launched forbidden.net-security.org project.

My idea was to contribute with a security article for their recently launched Newsletter and the article in question was a good old-fashioned “How to use trojan horses” manual. The article eventually got accepted and Dancho felt proud of himself for making a contribution to the project and having his article published so that eventually more people will read it and send him an email with questions about trojan horses and the actual article. The primary Webmaster of net-security.org at the time was Berislav Kucan and the project still remains one of my favorite and most popular visited security Web site on a daily basis. At a later stage I decided to establish a working relationship with Frame4 Security Systems which is a Dutch-based company for the purpose of writing an improved version of the original “How to use trojan horses” paper which later on became the “The Complete Windows Trojans Paper”

which quickly became one of the Scene’s most popular and highly read paper on modern trojan horses and how to use them and how to protect against them.

With the summer coming to an end I got an offer to begin to work at the local office of his ISP

(Internet Service Provider) which at the time was Digital Systems for the position of office assistant where he was responsible for introducing new clients to the ISP’s service offering and for processing invoices. Among the key benefits for working at the local ISP office was the actual bandwidth that he got access to allowing him to access the Internet without any sort of limitations which he used to visit some of his favorite Top50 and Top100 security and hacking Web sites where he eventually downloaded some of the most recently released 523

hacking and security tools including trojan horses which he copied on a floppy disk and eventually brought back home during the lunch break for the purpose of exchanging the information with his second employer at the time which was an anti-trojans vendor using a publicly accessible FTP server for the purpose of helping his employer improve the detection rate for these type of programs and trojan horses. I would then receive a payment for having collected and actually shared these programs and trojan horses which he would use to pay the bills at the time and actually pay for using his ISP’s service.

At some point in time he eventually got approached by a guy known as HeLLfiReZ who was interested in working with him and actually sharing his collection of trojan horses which he would then also share with his employer which at the time was LockDownCorp and earn revenue in the process. It would later come to his attention that the guy that approached him was actually one of the key members of the infamous Sub7 trojan horse group which at a particual point in time was responsible for launching a DDoS (Distributed Denial of Service) attack against the researcher Steve Gibson who extensively profiled the campaign and actually had a conversation with HeLLfiReZ and his team members for the purpose of finding out how launched the attack and how it took place. He would eventually run a personal hacking and security Web site archive using hosting courtesy of his employer LockDownCorp and run a popular Hacking and Security Web site which he would then feature on Progenic.com’s Top100 Hacking and Security Web sites including to actually offer paid security consultations in terms of finding out ways to help people protect their home PCs from trojan horses and teaching them how to use a firewall and how they can secure their home PCs.

At a later stage in his early Information Security career he would visit and join https://itsecurity.com’s Security Clinic where I would have his personal biography featured and actually respond to common security questions which users of the Web site will submit and have his response featured on the front page potentially driving traffic to his employer at the time which was Frame4 Security Systems and actually improving his knowledge and understanding of Information Security in general. Dancho was also known for having participated in the Blackcode Ravers hacking group which was running the popular https://blackcode.com Web site at the time and actually participated with two issues of a popular Security Newsletter at the time which were featured on the home page of the portal.

During the glorious years of IRC (Internet Relay Chat) where Dancho was busy hanging on several IRC networks including DALNet and his local country’s IRC network he managed to obtain the /etc/shadow password file for his entire ISP (Internet Service Provider) which at the time was Digital Systems and shared a copy of it with his best friend at the time George Kadiyski for the purpose of using several popular and high-profile Wordlists including John the Ripper password cracker potentially obtaining access and brute-forcing the entire password list for hundreds of active dial-up Internet based accounts at the time.

Over a period of several days the results at the time were outstanding in the context of actually succeeding in the brute-forcing process potentially allowing Dancho and his friend to easily access free Internet based dial-up accounts which at the time cost money allowing them to use the Internet for free. At a later stage Dancho also managed to obtain access to his local town’s competing ISP (Internet Service Provider) which was known as BIANet 524

/etc/shadow which was send to him by a friend and he also once again shared it with his friend who would once again begin brute-forcing the password file using a variety of Worldlists and the infamous John the Ripper passwor cracking tool at the time potentially allowing Dancho and his friend easy access to unlimited Internet based dial-up connectivity.

It would be fairly easy to assume how things got complicated with Dancho quickly obtaining access to Internet Relay Chat’s primary mIRC application including a variety of IRC-based

“War Scripts” including a dozen of mail-bombers and various other ICQ-based type of Nukers and Flooders on his way to demonstrate a proper technical know-how to his friends and peers in the shady world of hacking. Among the first channels he tried to access were #hacker

#hackers #hacking and the infamous #hackphreak on EFNet including to actually open several personal channels on the local IRC networks including #drugs #KGB and

#linuxsecurity. At a later stage he actually managed to ask a friend for a possible operator status on the local town’s IRC channel where he was basically running a 24/7 online protection bot known as xploit including the active use of a Socks5 server which at the time was offered by his employer LockDownCorp where he was busy acting as Technical Collector of trojan horses/worms/viruses and VBS scripts for the purpose of improving the anti-trojan software’s signatures-based detection rates.

Among the first thing that Dancho decided to do in his spare time is to actively research the local Webmaster of his hometown’s official Web site for the purpose of attempting to launch a social engineering attack against his local town’s official Web site which basically succeed and resulted in a “greeting” message being posted on the official Web site with no actual data destruction and data removal taking place in what would appear to be a professional approach when compromising a legitimate Web site for the purpose of greeting his personal friends and spread a message on behalf of “Trojan Hacking Group” which at the time basically consisted of one of his closest friends and another fellow hacker enthusiast. Among his responsibilities the time included the active collection of trojan horses/worms/viruses and VBS Scripts with the idea to share them with his employer which at the time was LockDownCorp one of the world’s leading anti-trojan vendors for the purpose of improving the detection rate for these publicly accessible trojan horses in what would later on mature into a successful Technical Collection operation which basically paid his bills and actually offered him a decent financial incentive to continue getting involved in security as a hacker enthusiast and actually improved his employer’s overall detection rate for some of the most prolific trojan horses at the time.

The actual contractual agreement had to do with Dancho using a private FTP server where he would spend hours uploading collected trojan horses using his home-based dial-up connection and eventually earning a revenue in the process using Western Union where he was happy to have established direct working relationship with one of the world’s leading anti-trojans vendors which at the time was located at — http://proxy2.stealthedip.com/maniac/incoming/

Whenever Dancho would attempt to reach out to his friends he would attempt to find out whether they are online using a popular trojan horse including to actually check his email account for their recently changed passwords and other related information including their current IP so that he can properly connect to their home PC for educational purposes.
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[3]

While Dancho was busy studying in the Netherlands he was busy persistently checking one of the World’s most popular and high-trafficked Web sites for hackers and security experts -

Astalavista.com - and sticking to the common wisdom circa the 90‘s where everyone was busy making contributions and launching new groups - he decided to approach the company behind the portal with a possible business proposal that basically consisted of having him monitor and actually maintain the portal in terms of content including the actual production of a high-profile Security Newsletter where we would produce security and hacking articles including a featured Security Interview with key members from the Scene and the Security Industry.

[4]
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What used to be a daily routine to work for ZDNet’s Zero Day blog for four productive years on a daily basis as a security blogger in between publishing personal research on my blog and later on receiving a direct offer to work with Webroot for the position of a security blogger was a dream come true where on both places I had the privilege to work and contribute with knowledge and research with some extremely knowledgeable and popular folks including my corporate citizenship passport which at the time was the crown jewel of my experience which was to visit InfoSec Europe 2012 in Earls Court in London with my company Webroot where knowing everyone and working with everyone from day one was quite a success and I’m extremely grateful for contributing to the growth of the company with my own knowledge and expertise and for basically that I have up to present day which was the highlight of my research at the time namely to join the company and enter the corporate world of information security and security blogging which I know so well up to present day and highly miss the productive days back then.

[5]
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Prior to getting a confirmation from a Team Member of the actual owner of the portal at the time Dancho quickly began entering into negotiations about a possibly paid including a free venture at the time where he could earn a small commission for producing a high-quality security newsletter and actually be responsible for all the security and hacking content at Astalavista.com on a monthly and daily basis. As he began working on the monthly newsletter the first issue including the remaining twenty six issues which he produced over a period of three years were quite a success including the actual Geeky Photos section where portal users could send in photos of their desktop computers for the purpose of featuring them at the Web site potentially promoting their desktop setups to our audience at the time eventually leading him and the portal to win a PCMagaine Top 100 Security Sites Award back in 2005. Among Dancho’s main responsibilities at the time where the daily updating of the portal with high quality security documents tools and presentations including actual hacking and security links and overall responsibility for all the content at the Web site including the production of a highly popular security newsletter at the time including to actually answer and work on possible partnership and advertising inquiries at the time which led to a successful repositioning of the portal as one of the primary information security portal services online.

[6]

528



Jessus. Who would have thought? At a specific point in my time and my career as a cybercrime fighter and cybercrime researcher including OSINT analyst and threat intelligence analyst at some point in time after approximately a decade in fighting bad guys and actually tracking them down and exposing their infrastructure I finally got a very interesting email which was basically a screenshot courtesy of a Russian Business Network franchise member that was basically showcasing ownership over their primary domain which was nearly impossible to receive and in specific the fact that the original and primary Russian Business Network franchise domain name doesn’t really exist in the context of having virtual no clues of its online existence which was quite a remarkable success in the context that it would have motivated many to pursue a pension in the field which basically included the actual message saying “hi” and greeting me which was quite a success at the time in the context of receiving a personal message from the Russian Business Network franchise proving ownership of their primary domain name. How did I originally stumbled upon the Russian Business Network? It was by going through other people’s research on the topic and basically by doing my job at 529



the time which was quite a success in terms of daily monitoring for malicious and fraudulent online activity which led me to stumble upon their malicious infrastructure on numerous occasions in specific to find out more about their rogue and malicious bulletproof hosting infrastructure which used to dominate the threat landscape at the time in terms of popularity and the primary bulletproof hosting provider for a variety of cybercriminals internationally. I was also originally inspired by the usual source of inspiration for me which was basically iDefense actual threat research reports at the time that were basically going a step beyond the typical threat intelligence reports and were basically including all the necessary and in-depth details on various cyber threat actors at the time including primary sources of cybercrime activity internationally.

[7]

Among the first things that I did prior to trying to pop up online back in full speed and fashion was to quickly built a set of projects including to launch several popular and interesting initiatives such as for instance Law Enforcement and OSINT operation called “Uncle George”

where the ultimate goal was to collect as much publicly accessible information on the bad 530



guys then data mine and present my findings to the wider security industry and community including to look for and present tons of actionable intelligence on the bad guys which could have been useful in the context of having vendors and organizations attempt to launch cyber attack and cyber campaign attribution efforts against these individuals.

At some specific point in time I came across the local for Bulgaria Cyber Security Talks event where I applied to make a presentation which got accepted which led me to eventually pop up at the event in front of eighty people and make a high-quality personal presentation on cybercrime research OSINT and threat intelligence including my general experience in the field as an expert in the field of cybercrime research OSINT and threat intelligence gathering where I’m an independent contractor since practically December, 2005.

It used to be a moment when I originally started getting involved in OSINT (Open Source Intelligence) as an independent contractor when I originally came across to the following document which greatly inspired me to join this space - “Reexamining the Distinction Between Open Information and Secrets” while browsing through Globalsecurity.org Fas.org Cryptome.org at that time. The primary reason why OSINT inspired me to become an independent contractor in this space in specific information security is the fact that a lot of the documents that I had to go through to learn what OSINT is and how to do it were either classified or publicly accessible however coming from important sources of information such as for instance the CIA.gov including various other U.S Government and U.S Intelligence Community sources of information. It is my opinion that the power of OSINT primary relies on the actual collection and working with the actual decision-making information using public sources which also includes actual enrichment and colleration between multiple sources of publicly accessible classified and declassified information which makes this area quite interesting to join from an independent contractor perspective in the information security field.

[8]
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At a specific point in time I must have gathered a proper momentum among my readers which I never really knew anything about including the bad guys in the context of intercepting a chatter mentioning me in a pretty bad context despite the fact that this is untrue as most of my research and the research that I did was in a passive mode namely I never really engaged anyone in specific friends and colleagues from the industry including the bad guys as I’m a firm believer that you can collect all the information that you need on them without bothering to interact or approach them. Among the few key comments that I’ve ever came across to referencing me in my entire career on a major cybercrime-friendly forum community was a Darkode discussion including a hitman request for me which apparently managed to find me one way or another including a second discussion which basically referenced my name and insisted that the same thing that took place with me back in 2011 will happen again. What really took place back in 2011 in my apartment in Sofia where I relocated on my own and where I insisted to live on my own and do my research using my ZDNet salary as a primary means to pay for my rent and living expenses is.

[9]

The primary reason behind this post is to tell my story with all the juicy details up to present day and actually offer an in-depth and never discussed before perspective on my research including to present and communicate the crown jewels of my research to a vast and growing network of readers internationally where the ultimate goal would be to properly present the true story behind my professional career including to offer an in-depth peek inside my teenage hacker years experiences while properly present my story up to present day where I’m an internationally recognized cybercrime researcher security blogger and threat intelligence analyst.

Dancho Danchev Presenting at CyberCamp 2016 in Spain How did I attempt to take down the Koobface botnet? Who’s Hilary Kneber? What was the primary idea behind “Keeping Money Mule Recruits on a Short Leash” blog post series? How did I prevented and actually detected a possible kidnapping attempt? How did I made it to the GCHQ with the Honeynet Project? Is is true that I’ve received an invitation to present at Canadian Intelligence Services? What’s my professional experience with my current employer WhoisXML API?

[10]
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I never really bothered to stop publishing content on my personal blog which I felt is an obliga-tion to the society and my readers who I really know nothing about in the context of presenting my knowledge and they will come and in the context of never really bothering to set up my Google Analytics property properly where I was sticking to basically monitoring my RSS Feedburner subscriber account which at the time peaked at 7,000 RSS readers on average on a daily basis which is quite a success for one man operation that never really bothered to know anyone from the industry in the context of basically presenting my findings and knowledge and later on getting surprised in the context of having folks and people from the industry approach me to say hi invite me to attend a conference share information or ask for information where I’m always there to appreciate their research and knowledge and continue to contribute with research and knowledge on my personal blog.

[11]
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[12]

[13]
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How did I attempt to take down the Koobface botnet? Who’s Hilary Kneber? What was the primary idea behind "Keeping Money Mule Recruits on a Short Leash" blog post series? How did I prevented and actually detected a possible kidnapping attempt? How did I made it to the GCHQ with the Honeynet Project? Is is true that I’ve received an invitation to present at Canadian Intelligence Services? What’s my professional experience with my current employer WhoisXML API?

What does rocking the boat really means? If it’s going to be massive it better be good. At some particular point in time when I was busy working on my personal blog I remember a moment when every day’s story used to dominate my life being in particular the fact that I’ve managed to tell a story for the purpose of sharing it and reaching out to my readership which at the time I was hoping that it was growing with several high prole daily users that I was busy tracking on a daily basis.

The juicy details? At some point in time when I was originally secretly monitoring who was visiting my blog using Statcounter.com where I was hoping to see someone famous I’ve noticed that I got a regular visitor from The Pentagon who was basically visiting the blog on a daily basis during not necessarily a specific time but in general which was great news and this greatly motivated me to continue posting high-quality research and news and commentary articles on various events that took place in the security industry including across the globe.

I also got several visitors from the CIA, the NSA including the FBI the NYTimes and BBC which was an outstanding audience at the time which was quite interesting to monitor and interact with at that time through my daily blog posts on a variety of interesting and high-quality topics.

Up to present day I’m a 38 years old security blogger OSINT analyst and threat intelligence analyst from Bulgaria. I’m currently running one of the security industry’s most popular security publications which is my personal blog - Dancho Danchev’s Blog - Mind Streams of Information Security Knowlwedge. I’ve been running my publication since December, 2005 and throughout 535

the years I had an overage of 7,000 RSS feed subscribers including 5.6M page views throughout the years making my blog an extremely important switchboard to the world of security blogging OSINT research and analysis threat intelligence analysis and most importantly cybercrime fighting research and analysis.

I’m also acting as a DNS Threat Reseaarcher at WhoisXML API.

Among my key accomplishments include my "lawful surveillance" and "lawful interception" experience as teenage hacker the production of the popular Astalavista Security Newsletter circa 2003–2006 including the "take-down" of the Koobface botnet [MP3] including a participation in Top Secret GCHQ program called "Lovely Horse" including regular appearance in major news publications for interview and expert opinion including Techmeme, ZDNet, CNN, PCWorld, SCMagazine, TheRegister, NYTimes, CNET, ComputerWorld, H+Magazine and regular security and research presentation appearance at major security events at GCHQ, Interpol, InfoSec Europe, RSA Europe and CyberCamp.

I’m an internationally recognized expert in the field of cybercrime fighting and threat intelligence gathering having actively pioneered my own methodlogy for processing threat intelligence which leads me to a successful set of hundreas of high-quality anaysis and research articles published at the industry’s leading threat intelligence blog - ZDNet’s Zero Day, Dancho Danchev’s Mind Streams of Information Security Knowledge and Webroot’s Threat Blog with his research featured in Techmeme, ZDNet, CNN, PCWorld, SCMagazine, TheRegister, NYTimes, CNET, ComputerWorld, H+Magazine currently producing threat intelligence at the industry’s leading threat intelligence blog - Dancho Danchev’s - Mind Streams of Information Security Knowledge.

With my research featured at RSA Europe, CyberCamp, InfoSec, GCHQ and Interpol I continue to actively produce threat intelligence at the industry’s leading threat intelligence blog -

Dancho Danchev’s - Mind Streams of Information Security Knowledge publishing a diverse set of hundreds of high-quality research analysis detailing the malicious and fraudulent activities at nation-state and malicious actors across the globe.

Key achievements include:

- Presented at the GCHQ with the Honeynet Project

- SCMagazine Who to Follow on Twitter for 2011

- Participated in a Top Secret GCHQ Program called "Lovely Horse"

- Identified a major victim of the SolarWinds Attack - PaloAltoNetworks

- Found malware on the Web Site of Flashpoint

- Tracked monitored and profiled the Koobface Botnet and exposed one botnet operator

- Made it to Slashdot two times

- My Personal Blog got 5.6M Page Views Since December, 2005

- My old Twitter Account got 11,000 followers

- I had an average of 7,000 RSS readers on my blog

- I have my own vinyl "Blue Sabbath Black Cheer / Griefer - We Hate You / Dancho Danchev Suck My Dick" madeby a Canadian artist

- Currently running Astalavista.box.sk

- I gave an interview to DW on the Koobface Botnet
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- I gave an interview to NYTimes on the Koobface botnet

- I gave an interview to Russian OSINT

- Listed as a major competitor by Jeffrey Carr’s Taia Global

- Presented at the GCHQ

- Presented at Interpol

- Presented at InfoSec

- Presented at CyberCamp

- Presented at RSA Europe

In the past I’ve been a member of:

* A Member to WarIndustries (http://warindustries.com)

* List Moderator at BlackCode Ravers (http://blackcode.com)

* Contributor Black Sun Research Facility (http://blacksun.box.sk) (BSRF)

*

List

Moderator

Software

Contributor

(TDS-2

Trojan

Information

Database)

(https://packetstormsecurity.com/files/25533/tlibrary.zip.html)

DiamondCS

Trojan

Defense

(http://tds.diamondcs.com.au)

* Contributor to LockDownCorp (http://lockdowncorp.com)

* Contributor to HelpNetSecurity (http://forbidden.net-security.org)

* A Security Consultant for Frame4 Security Systems (http://frame4.com)

* Contributor to TechGenix’s WindowSecurity.com (http://www.windowsecurity.com/authors/dancho-danchev/)

* Technical Collector - LockDownCorp - (https://lockdowncorp.com)

* Managing Director - Astalavista Security Group - (https://astalavista.com)

* Security Consultant - Wandera - (https://wandera.com)

* Threat Intelligence Analyst - GroupSense - (https://groupsense.io)

* Security Consultant - KCS Group Europe - (https://kcsgroup.com)

* OSINT Analyst - Treadstone71 - (https://treadstone71.com)

* Security Blogger - Armadillo Phone - (https://armadillophone.com)

* Security Blogger for ZDNet (http://www.zdnet.com/blog/security/)

* Threat Intelligence Analyst for Webroot (https://www.webroot.com/blog/) I would like to thank the following people for contributing to the Scene throughout the 90’s up to present day and for keeping up the good work part of Astalavista.com’s Security Newsletter which I produced circa 2003–2006.

* Proge -  http://www.progenic.com/

* Jason Scott - http://www.textfiles.com/

* Kevin Townsend - http://www.Itsecurity.com/

* Richard Menta - http://www.bankinfosecurity.com

* MrYowler - http://www.cyberarmy.net/
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* Prozac - http://www.astalavista.com/

* Candid Wuest - http://www.trojan.ch/

* Anthony Aykut - http://www.frame4.com/

* Dave Wreski - http://www.linuxsecurity.com/

* Mitchell Rowtow - http://www.securitydocs.com/

* Eric (SnakeByte) - http://www.snake-basket.de/

* Björn Andreasson - http://www.warindustries.com/

* Bruce - http://www.dallascon.com/

* Nikolay Nedyalkov - http://www.iseca.org/

* Roman Polesek - http://www.hakin9.org/en/

* John Young - http://www.cryptome.org/

* Eric Goldman - http://www.ericgoldman.org/

* Robert - http://www.cgisecurity.com/

* Johannes B. Ullrich - http://isc.sans.org/

* Daniel Brandt - http://google-watch.org/

* David Endler - http://www.tippingpoint.com/

* Vladimir, 3APA3A - http://security.nnov.ru

In this video I’ll discuss in-depth a variety of personal projects and current and ongoing both real-time current and historical research and analysis activities in the following categories such as for instance:

- My Dark Web Onion

- My Uncle George Law Enforcement and OSINT Enrichment Operation

- My Cybercrime Forum Data Set

- My Unit-123.org E-Shop for Intelligence Deliverables Project

- My Offensive Warfare 2.0 Threat Intelligence Clearing House Project

- My Disruptive Individual’s Threat Intelligence Feed

- My Current work as a DNS Threat Researcher with WhoisXML API

- How I ended up in Snowden’s Archive?a

- How I ended up on Wikileaks?

- How I made it into several comparative academic studies on the quality of sharing threat intelligence and cybercrime research information?

- How come I’m the only one listed as a competitor in Jeffrey Carr’s Taia Global Competitors Slide?

- What’s it’s like to run the infamous Astalavista.com portal back in 2003–2006 where I was acting as a Managing Director?

- What it’s like to get the privilege to work as a security blogger at ZDNet’s Zero Day blog for four years?
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 - What’s it’s like to work as a security blogger with Webroot for two years?

- How I ended up and spend the last couple of years doing OSINT on the bad guys?

- How I ended up having a project on the infamous Astalavista.box.sk?

- A brief introduction into some of the latest developments and research that I posted on my personal blog - Dancho Danchev’s Blog - Mind Streams of Information Security Knowledge

- How I ended up having a mobile application?

- How I ended up having a personal memoir?

- How I got busted?

- What it’s like to visit the GCHQ?

- What it’s like to meet the security industry?

- What it’s like to visit RSA Europe 2012?

- What it’s like to visit InfoSec 2012?

- What it’s like to visit CyberCamp 2016?

- What it’s like to get an invitation to visit Canada’s Security Service?

- My DIA Needpedia Investment Proposal

- How I ended up discovering a SolarWinds victim?

- How I ended up with a real-time OSINT and cyber attack attribution campaign on the Conti Ransomware Gang?

- How I ended up almost retiring and offering OSINT and threat intelligence training?

1. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjIrUBE5vSWyhCX0prs2skllQdD0763fmH296nhGGBNXNIaW

hH5mDqp7hHc7Lc970EHHUBLDxITEwWFRF9S8bVFQXNvLmljyQD0WKT

2.

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjx2R0R3S-AtX7a_2_-0HNawZ-d4E4L33ZzP74lt-5by0t

I974W-Ap59krkxspu8hm-_GxaTQIDl5HwACu5xZc0YOctCZQTUJC8nd4

3. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgasC03qsuXYzjSP8GBGvVE7cRS77dJpy23ridSgHUwlF7-A

TE1MS-t0cBIxt_WPsY-7hZcz30R91tBrnT04jAYgnSNqOdzlewK9es

4. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi8wmZbeEfpYVCsiBZgQQWprIjNMgtwTjOxC9Um7KyAEVuUr

nxbmyfzq9v52q5rrUfJVIm6p_6kqYrZ-GHygQEzczzvC1mkoNt9TOA

5. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg3F3QRgJgqHVz9vgc27dBHFI1yQrim81Ejb3pcsovTv9n9W

Erh1Wk3dG0snWD9JIh1lYVWHzLT1yWvxRrc3GrryYGvxgcp7drenya

6. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhvuVY1c3MfprClxj7wuhwidDcqj5otCoYygS7wa9jVLeoIn

6QeJv9f37n7TpO2ijlMPiWzYT8ov-OpqR-AeKmUbCM9gvC6l_JN8n9

7. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEghAFPVYKd6lWxOVdz_rr2i93N177Q1Dd61od3WMz0EAFuPp

2wD8m5sCqA3YNbopPPjZt-o_zHuDz6dXemtu--8xFMvXUhG2eWlQZB

8. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgd-R_8idxNh7ajmQnyX9jJW_3sbLdHEyA9GaAOVtBT2k9vV

dAcR6XrlOsUV5lrQio5-8P-BdybFiZpk8NYbxSeeXF1ohihOZZBvEf

9. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj7iaLRuuRz4-cccNNyHaLhUjSzYVPBiXmxBRJH7s9ZQot9z

d6uV939qsi5nUzoyL3A9bQFu9PrpOsxPH5BK1poPLudMkJpfVlxkcG

10. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhuIFEnYma_lW-q0WvBprJpv_lSytkn-VA74CNj5fdDmQv

Tqi32mufOiK9MDXE1u8z5GO1KGNLotcTDAlBXBvSxFCvmF2cN_DqR6sc

11.

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgnndTPZ5M3errC8bJq-GUjOve_Rv7yFhEtdWmVDH3eXAF

0_1a_e0HkEFkJwXEa_IOzSRukoto5gPGcIdqzHeQ6nX8fKpOKmUI4PLO

12.

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgrJLkn9j6dpplxlBl8uBSl0CJcgoryVMx4Ujt0sss6NCV

qBFRnTG7_Rk3hm5sawuhmGdmmdHUd764xAZDZn8EFlHrZPpvP9mOv-dJ

13.

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgFn4U4te948sl19t3z9g3EIBEIA_p1HaFTE5yFjdBefLQ

zMd_VsabZEZjopWbxLmszJRc62xGT9vVZm3GkHjut7tDQTx2r5txpj43
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1.2.16 Exposing the Web’s Most Prolific Malvertising Operation Circa 2009 - Exclusive (2023-04-28 17:24)

[1]

Who remembers the 2009’s malvertising campaign (hxxp://trueconv.com) on the NYTimes and ESPN including FoxNews at the time which was dropping scareware also known as fake security software on the hosts of affected users who appear to have clicked an interactive advertisement on some of the Web’s most popular web sites at the time part of a rogue and sophisticated malvertising operation courtesy of Russia-based cybercriminals at the time who were monetiz-ing the fraudulently obtained and hijacked traffic using a scareware affiliate based network at the time?

Keep reading.

As I spent some time going through my old threat intelligence archive circa 2009 I found a crown jewel part of my research at the time which could be easily considered a must process enrich track down and analyze malvertising operation up to present day where I’ll do my best to assist everyone by sharing as much information regarding the Trueconv.com malvertising operation at the time including affected parties the actual URLs and domains known to have been involved in the campaign including related IPs and will do my best to speed up everyone’s work in terms of further processing and analyzing this campaign by using known historical OSINT processing and enrichment techniques.

[2]

The good question? How I got this data? It’s be figuring out a way to access access the publicly accessible statistics on the primary Trueconv.com malvertising operation domain circa 2009
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which leads me to today’s analysis of what appears to be the Web’s most prolific malvertising operation on a wide scale circa 2009.

The research in this post can be easily considered the malvertising market segment’s largest OPSEC failure even since it’s growth stage back in 2009 where the primary infection vector here was clien-side exploits and social engineering and where the most affected and targeted operating system was Windows XP where I’ll do my best to offer as much historical and actionable intelligence on Trueconv.com’s true widespread campaigns back in 2009 by offering a complete listing of all the actual URLs involved in the campaign including the associated domain names and affected IPs based on publicly obtained back then misconfigured access to their entire logs database which easily proves to be an invaluable wealth of information on the most prolific malvertising market segment operation back in 2009.

[3]

Email address accounts seen in the log files:

22info@cafesferraz[.]com

-itsrainingforyou@gmail[.]com

acummings@paulding[.]k12[.]ga[.]us

belew@comcast[.]net

20itsrainingforyou@gmail[.]com

taffytiffany@yahoo[.]com

mwdsmanagement@coxinet[.]net

royalcrackerzzz@gmail[.]com

cubilonsa@gmail[.]com

20royalcrackerzzz@gmail[.]com

jxpecaban80@hotmail[.]com

paraexca@globetrotter[.]net

www@oprah[.]com
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xpcar _003@live[.]com

contact@parc-vxpges-nord[.]fr

cjn@justice[.]gou[.]fr

susan@susanforrest[.]com

Scottsmbnt@aol[.]com

scorpioascendant@hotmail[.]com

[4]

IPs seen in the log files presumably the actual victims of these campaigns: 74[.]125[.]47[.]132

93[.]175[.]232[.]154

76[.]88[.]137[.]98

141[.]151[.]8[.]158

193[.]178[.]34[.]38

58[.]65[.]245[.]234

152[.]13[.]71[.]24
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98[.]161[.]15[.]161

131[.]118[.]124[.]167

71[.]226[.]92[.]54

75[.]185[.]213[.]12

75[.]183[.]68[.]64

76[.]31[.]128[.]166

96[.]238[.]184[.]188

69[.]86[.]199[.]68

64[.]83[.]248[.]84

74[.]255[.]195[.]114

75[.]35[.]242[.]17

98[.]166[.]33[.]128

66[.]56[.]233[.]79

76[.]226[.]11[.]79

71[.]169[.]141[.]118

67[.]142[.]162[.]29

24[.]44[.]162[.]69

76[.]116[.]61[.]212

168[.]16[.]193[.]126

199[.]227[.]146[.]82

173[.]21[.]59[.]245

71[.]226[.]132[.]134

67[.]11[.]245[.]57

64[.]26[.]97[.]84

68[.]46[.]43[.]26

65[.]11[.]141[.]87

72[.]65[.]156[.]146

12[.]14[.]199[.]234

67[.]243[.]42[.]115

173[.]16[.]28[.]182

67[.]166[.]227[.]243

96[.]238[.]93[.]124

75[.]185[.]155[.]89

67[.]176[.]141[.]242

98[.]166[.]139[.]228
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24[.]58[.]111[.]195

72[.]72[.]214[.]6

68[.]197[.]139[.]65

71[.]41[.]177[.]66

74[.]176[.]184[.]48

68[.]191[.]9[.]132

69[.]27[.]229[.]11

96[.]39[.]175[.]73

74[.]166[.]122[.]66

24[.]47[.]5[.]144

12[.]52[.]253[.]141

168[.]13[.]223[.]66
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LoxWZFbiH4aoB6zMVG56wvD4dYm_JvJovLSetDYY6VFggUjitylAiC
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an4hGzjLzgoSjc_AQ3TFkUtH41PrsUZGu2nvmiBVbhDenGBfsFGIun

1.3 May

1.3.1 Exposing the Ukrainian Insider Trading Hackers that Stole $30M Using a SEC’s EDGAR Securities Fraud Scheme - The Technical Details - Exclusive (2023-05-01 14:23)

[1]

" An OSINT conducted today is a tax payer’s buck saved somewhere".

Official U.S Secret Service [2] $1M reward listing on [3]U.S Secret Service’s Most Wanted Cybercriminals List for "[4]Oleksandr Vitalyevich Ieremenko".

Handle: Zl0m; Lamarez; Ded.MCz; l@m@rEz

Email:

lamarez@mail.ru;

uaxakep@gmail.com

-

xeljanzusa.com

-

62.109.25.228

(https://www.secureworks.com/research/point-of-sale-malware-threats); 62.109.1.69
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[5]

Commpany: 2016 Кзерокс

Phone: +7 951 366 17 17

ICQ: 123424

Web Money: 258807111393

Related URLs:

hxxp://ageline.ru/lamarez.php

hxxp://k0x.ru/md5.salt.tx

hxxp://k0x.ru/ _bot.exe - 82.146.60.59

hxxp://k0x.ru/black _energy _31337 _/stat.php

http://k0x.ru/siicywu36dswh/addddos.php

hxxp://xtoolz.ru

hxxp://cup.su

hxxp://xwarez.us

1. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiRnzwKaQ8VexF1mDf3NTOjvLDSCpkceYKIu4h1VSHK3fQdo

EHX19BhQj3BK1VVypohCIf6bjOqlh3hxufo5DVi99yc5FdaXj8vlte

2.

https://www.justice.gov/usao-nj/pr/nine-people-charged-largest-known-computer-hacking-and-securities-fra

ud-scheme

3.

https://www.justice.gov/usao-nj/pr/two-ukrainian-nationals-indicted-computer-hacking-and-securities-frau

d-scheme-targeting

4. https://www.secretservice.gov/investigation/mostwanted/ieremenko

5. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhptksUVrVFixFL7QyPC4HCR8vaKuDrOPFtlUgYBZdimmBPB

SXbkGrrrpWdtpwHkmCOWCppH2ndGHdwyPBdhv6S-UTkt616zmDwIEa
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1.3.2 Who’s Behind the Butterfly Bot/DCI Bot/DownTroj/Aspergillus Botnet Malicious Software? (2023-05-02 21:17)

[1]

[2]Awesome.

Emails known to have been involved in the campaign include:

iserdo@gmail.com

toadmin@1337crew.info

wg.fatal@gmail.com

emailedgov.hacN@gmail.com

admin@1337crew.info

jernej _5@hotmail.com

usediserdo@gmail.com

toiserdo@gmail.com

schlist90210@gmail.com

Waisted.time@hotmail.com

addressnetNairo@hotmail.com

betweennetNairo@hotmail.com

hamlet1917@hotmail.com

addresshamlet1917@hotmail.com

withhamlet1917@hotmail.com

floxter@hotmail.com

ice@iceman.in

addressleniqi.mentor@siol.net

leniqi.mentor@siol.net
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accountiserdo@gmail.com

addressicemangjN@hotmail.com

Sample screenshot:

[3]

Related domains:

hxxp://voc[.]cash

hxxp://deepbluesecurity[.]nl

hxxp://erc20collector[.]com

hxxp://b2bradio[.]net

hxxp://threatforce[.]net

hxxp://intelhub[.]link

Related screenshots:

[4]
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Related screenshots:

[5]
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Related domains:

hxxp://voc[.]cash

hxxp://deepbluesecurity[.]nl

hxxp://erc20collector[.]com

hxxp://b2bradio[.]net

hxxp://intelhub[.]link

hxxp://albahost[.]net

hxxp://albaname[.]com

hxxp://mpuq[.]net

hxxp://albaname[.]net

hxxp://threatforce[.]net

hxxp://tamiflux[.]net

hxxp://tamiflux[.]org

Sample screenshot of Voc Cash:

[6]
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1. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj6vcKaxjmyd3SjesWPnGLqSMVhOOv2Nw_3SlhKIyIPu1RcM

I4LjTeblEGVSgG6rBJwKU5d0YseAWYPB9EsvPIMuAsy4GdyGZ63Igo

2. https://www.justice.gov/opa/file/630811/download

3. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjbKhk9ovr4OiX08FEfWaNZ1e-a6bV13scby78PjXihBiLuZ

5v_w-4bC4kFXg4eLmwR2ciSp0Rj2Xqg4s4Okc9V3IRp7yN2uUHE_tE

4. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiaq6LvCWsNjPesx3M68RC7SDE0kBIPtdK9hmescakKv4E8O

PbrUE5_zQkRSF8oE4gKQTThLgOB6t7p8PLWaLsoS9JwK7BlMYr0mQ5

5. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi3H-DqRerHDRx5cOej8-69XyRqLHM8c_9jAuP8pOSzEM81K

VH72H6ZHqMx1l7vb_8I4-WIPaKAioFbR08cssuA9tnjZFTzC_9E-Li

6. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj3BrjzNAIt4IlQhpgBi7laZDxb4mh0F1VLvezr7hcZ73-lO

Nrp6KyMpnJQovcjFqqAtIV7YSwtc8GTbvU4glkEock4l3-JldHBYEX

1.3.3 How Do Cybercriminals Manage Compromised Hosts Using Desktop Management Applications? - An Analysis (2023-05-03 20:42)

[1]
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If an image is worth a thousand words then check out the following which although released in 2006 appears to be one of the cybercrime ecosystem’s most sophisticated and advanced compromised hosts management tool within the ecosystem up to present day.

Sample screenshots include:

[2]

977





[3]
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[4]

[5]
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[6]
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[7]

1. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhM8Su4uVFM6Uf-pTWMN5U-kk6NqQIEffTzwW4JrfEyHGNzd

ffk-gEJpLuaOEDStxGxyVrXlXK9DjkfBhcI173gq6YblKzZT_mhm2x

2. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhQBYsOy_kfiV7iT0fYSAfoGXwBFaKIH5dnb-Cj0orOXg21f

A_cxAR9Cib6BLrgpzw-CoI_Ygcach3RX48S-5_kkRx3W23UST5HQku

3. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhgoHxee2gFJRl5gV2S220onZPvAoDOynBO_cEkjm2oZpfUA

ZlltjgBBWcbaTGgZhvIac6JrJg-HfvDjRLnTRdmHTOuQwFiRmbue5M

4. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh8MQm7U2E31mSf5bHA1YMWSbtdjWlo5_Bvrqlvzw3xY0NaA

emABSO24rFO8mf428hq1ovAnvLLz1VLtIiArS9HnAza9f8Gjci4yfW

5. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEinjFrqOVFvFUVnJutzbUyZ-GEBzxo5VurZvHyG0OB8nt8hm

MkC2OfxanHGFyH7X1yoov8ixTr4at_O1Fr3Tn1ISdS6JYNVvkQCkgE

6. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjHaX-9lOlmXAhj3FekDJSOOkmReSklqOCNVTPx3C9EX8CNI

N4g6CCrPPd-HekYCT2H8HERXZuCyOvxxu0QMaOUSxV-AlolRy-nWuw

7. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiQHL9lEPgDhnD_42A7kGnUI1SjuVAqoCJPiheWoaTTsk-Ub

V7q50xg-ibjwKT5yZp8RHHDRi9KCAzMaaEGqONTUtbI1K6MkyTEdPO

1.3.4 Hacker Database (2023-05-07 16:37)

[1]
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I would like to take the time and effort and let you know about my latest project which is called

[2]Hacker Database. Obtain access [3]here.

Sample screenshots:
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[4]

[5]
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[6]
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[7]

[8]

[9]
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[10]
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Sample visualizations produced using the database in GraphML format: 1. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg6ifpcxMIQSCJnCSdH9aAOs0c1dSjpE0b3TZjbIGOL4LOr0

CH8fjxIw55gvgJPe-t4p2OqvbDeQ1NEW3t-5vlk2sC4w5HQq5Alwgo

2. https://cybercrime-maltego-graph.org/

3.

https://cybercrime-maltego-graph.org/introducing-maltego-and-graphml-compatible-live-and-historical-hack

ers-database-v-1-0

4. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgEW0Wm5NI3vr3WfpIoVUWcLvLKEWZcvlY-AcygC9djm3mSn

lvLNtuyIXwgIBXD1sdwtdK9GXGgrizVfnH6EYmY_n1eoRLFRw70zXB

5. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjpMV7PUwDQbsXwGGBOdPc8hKNWDOj1S3F0c4bMFnqfWYpti

bcRpjF-sXXmkHR56sEVnJ3NUy_xMtGSgzWQePPNzN0yu3PQgWlF7pT

6. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgKD3YCtuJW8Ig9wWqtzGezPyVVsC5IA37XTiFKPZDHkm3Wh

UPS1A523ulqHJBEEaKhVFEMrNF1zVQOaqIcbJyXpxkLem7y3VW-80J

7. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjbvnkc0B0s2UUEGK_tTY-9-fcNJ5BA7IfcfMxsvj0QNo0_p
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9kteMgcLK8GHySFXjJA3ulABoy0fxJS-ddF8PHlw9QJD2RVmOkMKJ1

8. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg6SHGRhxSMjIIHzwHs1B3NkkDC_a759TkE4X-QtX90iiSx-

Dz49mT4OrbNmY0X1vbYQA_RtcR72-TFVV9bfrSmt1vdpn2UU36O4PW

9. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgPVD57OSfC4Ftx_BbA8mrTiUn39OehiubF9fSEjyFkjGPQe

SThRKCnbIToRxSBpn9K3x7hhwZw25CJWj2UW2MOsaAo4-wom4dBb0C

10.

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEglTntb-mPIbpKhJHO0HQKZexD45cn2Rj5z7GN6Uj2neLn

yEjX1zejBO3RpN4BRQIdoLbHdn-YJpC2dROnqC-Dq9fDEtQoWp2L9j6Z

1.3.5 Happy Holidays From The (Not) Republic of Bulgaria - An Analysis - Part Five (2023-05-08 19:25)

[1]Dipshit. The [2]deepest of them all.

[3]
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[4]

[5]
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[6]
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Stay tuned!

1. https://linkedin.com/in/yavorkolev

2. https://youtu.be/KtGFByAJRQQ

3. https://blogger.googleusercontent.com/img/a/AVvXsEjxMuK71REGwmjX99RgzXAy4wYdfDx42QBtrEtm_pEd5AP5TcmikOsSLc

R_q8w50QnRcW--jJDYH43nQXTyTAa__d5jqs4WwiX50e9cr5D7O-Ky

4. https://blogger.googleusercontent.com/img/a/AVvXsEi455l6ejzXCcBZX5vpR_D2vMudSVF9B6uzZCBoQLz4i0zgGS91WLYMPJ

jxD0dhYxA4oXTs2hx8WHKt5LSGQiP-aWekG5VnfIK2D6_XbZQlSSkp

5. https://blogger.googleusercontent.com/img/a/AVvXsEhA1M3s_4XBe3MrIdxRo1Y-cTQScjH7u5K_6Og_K6XdGMhu_3eNsHCNo-

QiP6dItlWtaBeksqJaKTYqL7Cg0OIRbBRuft0ndOUYI7YayB0oMs9D

6. https://blogger.googleusercontent.com/img/a/AVvXsEi1avC3NL_HFtA3MvMFlVEamlSrVqZ89C7Jyy1aQrJc8RthKuIthKKM33

kZG77GrIG4wjIgkQW1s4GqM4wFbQQ1bWaij7G8DUmrfEBiRMCl_Wio
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1.3.6 Exposing Hacking Team GhostSec - An Analysis (2023-05-20 13:03)

[1]

In this post I’ll profile Hacking Team GhostSec and I’ll provide all the relevant and necessary IoCs (Indicators of Compromise) including all the relevant personally identifiable information in terms of assisting U.S Law Enforcement and the U.S Intelligence Community on its way to properly track down and monitor and prosecute the cybercriminals behind these campaigns.

Personal Photos:

[2]
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[3]
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Related IoCs and personally identifiable information for GhostSec: Official Web Site URL: hxxp://opiceisis.strangled.net

Official Web Site URL: hxxp://81.4.124.11/index.php

Official Web Site URL: hxxp://pst.klgrth.io

Official Group’s Twitter account: hxxp://twitter.com/ghost _s3curity Official Group’s Telegram account: hxxp://t.me/GhostSecc

Official Group’s Medium account: hxxp://medium.com/@OfficialGhos tSec Official Group’s Web Site URL: hxxp://ghostsec-team.org

Official Group’s Web Site URL: hxxp://ghostsecret-team.blogspot.com Official Group’s Email Address Account: ghostsecteam.org@gmail.com Stay tuned!
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1. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjSvcnYYY17N_UBVADe8CNoeMoGPVbwwcgRQou5GyFubNjuV

DIJAasIgQY-2bjJmWHxRdIpQUgrk9WRVc_vhGMpkRpbFgxhDG6itY2

2. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgr0-LPZxubfPjEF4nCX9Cut3s7FXStdwze2KcMmlzD-uo-T

CYxecoSFX6A2hJQKrd3esC4rGna7e7CsNOT08ahNeOZjt2Seda0KLb

3. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiCOOcVHyrrCVSa7F0VBYI-XJk4zxy5GF0WJYph_TAPInIcH

FH1DLzmeHim5BYuhKbsAMaEHPQHdYenIj3KMqJuqSUsrpyQpstKo8m

1.3.7 Exposing

The

"Denis

Gennadievich

Kulkov"

a.k.a

Kreenjo/Nordex/Nordexin/Try2Check Cybercriminal Enterprise - An Analysis (2023-05-20 13:04)

[1]

Who would have thought? The U.S Secret Service is currently offering $10M reward for [2]Denis Gennadievich Kulkov also known as Kreenjo/Nordex/Nordexin who’s particularly famous for running the infamous Try2Check credit card checking cybercriminal enterprise.

What’s so special about this individual is the fact that he’s also been running a well known money mule recruitment operation since 2016 using the World Issuer LLC money mule recruitment franchise based on my research using public sources where we’ve got the actual hxxp://worldissuer[.]biz domain registered using identical domain registration information such as for instance hxxp://try2services[.]cm including several other domains such as for instance hxxp://dam-shipping[.]com and hxxp://cloudnsman[.]org and the following domain which is hxxp://elementconstructiongroup[.]compan y.

Among the actual domains known to be part of the Try2Check cybercriminals enterprise include: hxxp://try2services[.]pm

hxxp://try2services[.]cm

hxxp://try2services[.]vc
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[3]

including the following domain:

hxxp://just-buy[.]it

including the following two ICQ numbers 855377 and 555724 and let’s don’t forget his personal email address accounts obtained using public sources which are polkas@bk.ru nordexin@ya.ru

[4]
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and it doesn’t get any better than this as we’ve got a pretty good and informative domain portfolio registered by the same individual based on public information sharing the same domain registration details such as for instance hxxp://worldissuer[.]biz which actually are:

[5]

hxxp://cloud-mine[.]me

hxxp://gpucloud[.]org

hxxp://hyperhost[.]info

hxxp://miservers[.]info

hxxp://carterdns[.]com

hxxp://reshipping[.]us

hxxp://keyserv[.]org
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hxxp://antmining[.]biz

hxxp://investmentauditor[.]com

hxxp://sunnylogistics[.]us

hxxp://try2services[.]cm

hxxp://greatwallhost[.]net

hxxp://jaqjckugrfffqa[.]com

hxxp://numberoneforyou[.]net

hxxp://getprofitnow[.]biz

hxxp://avsdefender[.]com

hxxp://spyware-defender[.]com

hxxp://beta-dns[.]net

hxxp://mpm-profit-method[.]com

hxxp://public-dns[.]us - [6]related including [7]this

hxxp://adobe-update[.]net - Email: krownymaradonna@onionmail.org related domains known to have been involved in the campaign include - hxxp://amazon-clouds[.]com; hxxp://microsoft-clouds[.]net; hxxp://telenet-cloud[.]com; hxxp://vmware-update[.]com hxxp://kwitri[.]net

hxxp://dcm-trade[.]com

hxxp://karoospin[.]biz

hxxp://fastvps[.]biz

[8]
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Stay tuned!

1. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhENvPuP0uf9nRgbd5daVF87zQubPqBaoIdRD7JuIamtxVox

02lcvQADO7lDE-fIE78C-OXBqakR3jj951HlRbYkKgXJwhnGtnw55n

2. https://www.secretservice.gov/investigation/mostwanted/kulkov

3. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi1Dfy46wY7jWqspJJ2NlLR4yo_y07V1oVsV8A5EsuS81Yom

QpaiGDgua4mxgWMBjKg1uVJ_hGA-d5AQmnKG2aAjWOIYyTUoNa4W4j

4. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjvdHmjh9lyAdAXrFXp7py1ShBNjvaOtT0JIgTlUvT_Z6yat

0WzrbxKfp8g_0DUqZ1iv_wYGEg_OAupEHjoZr_kHae16PXlx9eVvvD

5. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi28SwA4jvWdHpsMlDvTUdSNwZ-H9oOyG82IZ-C0YX16QwAK

KnqoRM-YJEaEiUHnBk8JaYMevpJsjprIf98JD794yu5scb12fGq4hr

6. https://cloudsek.com/threatintelligence/carbanak-fin7-crime-gang-threat-intel-advisory

7. https://cyware.com/blog/carbanak-insights-into-the-billion-dollar-bank-security-threat-284d

8. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjKMqYhgUiGAeFbQZEnnYAbQD5mCh3zi9-TcqwbeuGbH53-N

am0pdCkqYS-Mm5RtFXK3bLy6WcBA0i0ftcN-ySaVbeZQJER1tQ6A9I
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1.4 June

1.4.1 The Ransomware "Epidemic" - Or How To Strike Back? (2023-06-02 11:19)

[1]

Not only did we live to see it we’re actually living and taking actions one way or another to see it and yes it’s the ransomware "epidemic" that I’m referring to and which I’ll try to expose in this post by not only providing the typical for me technical details and related action and response initiatives that I’ve launched in the process but also provide a relevant and in-depth understanding of the modern concept greatly inspired by a free resources which I came across to on Twitter today namely - [2]Ransomchats which is outstanding and almost unbelievable initiative that offers an in-depth peek inside the supposedly secret chat conversations between ransomware "customer support" and the multi-billion dollar victim which in this case is a reality.

Greatly inspired by the general availability of this free resource I’ve decided to dig a little bit deeper inside these publicly accessible of what appears to be proprietary conversations using a popular tool which I’m using to cluster and produce graphs of current and ongoing conversations between the bad guys that I come across to and provide my point of view on a surreal problem that’s being fought with the wrong resources and technical means to begin with and further elaborate and actually share the results of a sample experiment that I did on the topic in basically my spare time.

Sample graphs based on the recently released communication courtesy of the Ransomchats project:
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1. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEikOkTyCpCFUPx8Z2d0M5Utywof6N6kO24FKlK4ajaSVgq3m

FsOo7d2mxPFzNXJmRfoR4kq5u_ZZfst2Nr11Pk06J_KPHj1A4vzhWh

2. https://github.com/Casualtek/Ransomchats

3. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEilidZV-NaZpcv_43DuRbfWalS_xRwP2rf7dTFM6oy4iuRdy

KK1t4Z8eukAmHlEHMJdaCNaFtxeB22rYvERM8gwcznwjxcQCNFKN-H

4. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhhwpZaRfptd8SKq6aMQthpQRY8Xv_5GXFG_HY4WSRSF94D0

un7gzEu09jwVyrXOaEjcqynYTmwxDBFxfW_tGaRDXNrzHFfnqovITo

5. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi2BmU3REbmk3zm84-RHapIyAi9yB-1mEctAId5xlQZ-g4wp

pMJc3fFlUgRmvVgrkx9bgRVhyOMXSL5ODhY1yosgiQ7_4xYuD5jotv

6. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgP9Piw6FuffoJNwSNIU7-3fDKHuzLbRxgLP_H-l8NmyJMe9

_6-oBvYOaYOZ_mBNQrppOoh2_hl88yr9yPdhkPo8T2OOSGojyIbu6M

7. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhJJFofHXsXvrqh7Tt_bGQcX3rA39uy_h3uGxl38P8_jyeel

rgfCsg0SKcZZJLWwoHdtISq2LjUTlpl-0LV_5SFeeyqt41VHV8lHAC

8. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhUnNpdkbuqDaR23EOB9CFeHVvs9e9wQk9F_-z9CrV3xnX_d

B1Z93JV_PMJyuT7Y-KH6hPWEnILWk-c0MYjL0eJdjQV_0Uhwb_38S1

9. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjeDMPTw-1LO70gFH18xdxhEGa2YzMZBKuv1Ryf6Vh-Pu0Yb

Z0FOF4Kfps-AyT0l-UnqoR_NtWyIABiWRi4pBP5WPeFlDa7IWf-kr6

10.

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEibpdBEyIiCrCCoa1Ns1rF-eiAxgWqnhOygBG6ucyYQC7t

7014tLotGIi8_jC0PP8GcF2khXY82-9Ds58DA3js2zrjCJe_fo5nkkKs
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11.

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgMgAUUZ3ilziHOkzKJqRxEwGB3dKbgWpE7DXSRRxKI8CY

_YP26CgnYeOLHtHWpePGgKq_AIZyuZF531fB4_YNh8BM0z6bMq_1WbK1

1.4.2 A Brief Overview of U.S Cyber Command’s Global Cyberspace Operations Synchronization (GCOS) Concept - Or Can We Make The Difference Between RealTime and Synchronization in Cyberspace? (2023-06-02 11:21)

[1]

It should be clearly said that the current state of the U.S Cyber Command’s overall Global Cyberspace Operations Synchronization (GCOS) Concept is fairly naïve and a bit childish in the context of what I can best describe as real-time cyberspace operations where the primary difference between synchronization and real-time can be best described like Feedburner vs OSINT as a concept where Feedburner despite being a well known product and a service is basically delivering its content and features using synchronization compared to other modern approaches given the fact that they can be achieved such as for instance real-time cyberspace operations where the ultimate goal would be to achieve the unachievable namely the use of real-time cyberspace operations compared to marely synchronizing them to achieve something that I won’t really elaborate on such as for instance the surreal synchronization of U.S Cyber Command cyberspace operations compared to real-time cyberspace operations.

Real-time communications have to do with pushing the very boundaries of an individual or an organization sticking to common good where in most of the cases the common good can get someone in trouble.

I’ll now proceed and give you a pretty decent of something that I’m unknowingly extremely good at and a process and a concept excluding the fact that it’s not a process at all in case you 1012





can’t or don’t really know or bother to implement it but rather remains a bit of a commercial and a bit of a sophisticated practice known as military and cyberspace deception and cladestine and special cyber operations type of activity where the ultimate goal would be to eventually make people and folks laugh one way or another based on what can be truly achieved here.

Let’s take a moment and give you a brief example on the process. Military and cyberspace deception and clandestine and special cyber operations activity as a concept has been around since the early days where I originally began preaching on the use of "People’s Information Warfare" by Chinese hacktivists where the ultimate goal would be to crowdsource the actual bandwidth for a particular campaign to the massess and actually to sometimes unaware end users and organizations which believe it or not takes and it better doesn’t to another direct namely the MakeLoveNotSpam project initiative dating back to 2004.

"Setting the globe" based type of scenario is a bit childish explanation of what global segments of synchronization really means compared to real-time cyberspace operations and what should be really considered here is the true nature of what real time really means in the global context of cyberspace operations.

1. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjSUJOf9f6KswuZPZbWYm062AbWPXzqRf0jTEGeloRWgPHiG

r3hkHYzhc5DpDIjadZEc_eiLYA9woPdoMcPMjBswWoXX8hnodOyS3T

1.4.3 Assessing the Current State of Cyber and Cyber Military Deception Concepts Online - Part One (2023-06-02 14:30)

[1]
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The overall state of today’s modern cyber deception and cyber military deception online has to do with a maze of sophisticated and advanced asset camouflaging activities including a basically a state of overall cyber dominance and cyber power in the context of systematic professional and sophisticated control and distribution of information locally including internationally in the context of having others not just perceive but actually do something provoked or prompted by a sophisticated information campaign distributed in a classified or secret way.

The primary purpose behind coming up with this post is to shed more light into my understanding of the overall concept and to actually demonstrate and give relevant examples from the field.

Misperception:

Among the few basic concepts for starters in the field of cyber and military cyber deception 1014





next to information operations has to do with misperception where the very bottom of a specific concept is basically twisted to the point of having others do things and make impact in the information camping without really perceiving the true state of the process where others will eventually benefit from what you’re initially prone to believe and will even greatly benefit from what you’re actually about to do based on the specific information operation.

Surprise

A closely kept secret and an information operation is everyone’s surprise at a later stage when the actual implementation phase or actual maturity if any phase and finally the actual launch of the information operation takes place leading it to become everyone’s surprise.

Deception

The very basics of cyber and cyber military deception has to do with a very but closely kept secret word and a phase where the ultimate reality is that this is a process known as on purposely or indirectly both consciously or on purpose making others think act upon or actually believe to a certain extend and take action basically the process known as a twisted reality.

Deliberate misleading

The process has to do with either attempting to trick or entice an individual or an organization into heading in the opposite direction or coming up with a process that can either sort of impose costs to its current upcoming and emerging both real life and cyber operations.

False represenation of environment

This is a relatively sophisticated process both in real life and in cyberspace that could ultimately lead to an utopian world or everyone’s dream come true reality where we could have entire cyber populations both malicious and not malicious act think train and even educate themselves based on a wrongly perceived reality where the ultimate goal would be for someone to basically manage a cyber deception and cyber military deception information operation where the ultimate goal would be to launch and actually monitor its process throughout the decade.

Everything that’s seen can be actually hidden

This is a relatively advanced and sophisticated approach that entices users and organizations into living in the other side of the world where the ultimate goal would be to portray a situation or a specific information operation where the ultimate goal would be to entice people and organizations into taking action based on the information operation.

Everything’s that’s ready is actually unready

This is a similar approach that could take into consideration the timelines of events and an individual’s or an organization’s development cycle for a specific purpose where the ultimate goal would be to launch an information operation.

1. https://blogger.googleusercontent.com/img/a/AVvXsEgpW2-XCiLggsuhnat8_5Py4__9EUf5vsK3ObGHQHikka_rth0FRfu6cB

cefXZUzyeF6vkZSWrdcZRzDCP_uhjQ-Y3F6UakVQZMqWvrYHAvYD3p
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1.4.4 Dancho Danchev’s OSINT and Threat Intelligence Training Video Demonstration in Bulgarian - Part Two (2023-06-04 07:12)

[1]

I’ve decided to share with everyone a recently released YouTube video demonstration in Bulgarian on the topic of OSINT and threat intelligence training.

Here’s a sample Table of Contents for the OSINT and the Threat Intelligence training in Bulgarian:

Кой се интересува от индивидуално или групово обучение в сферата на OSINT анализ и превенция на кибер престъпления и анализ и обработка на кибер

атаки известен още като практиката Threat Intelligence?

Можете да видите

моето CV тук - [2]http://disruptive-individuals.com/wp-content/uploads/2021/11/Dancho _Danchev

_CV

_2021.pdf

портфолио

от

анализи

и

проучвания

от

2005

до

2023

тук

-

[3]https://archive.org/details/@ddanchev

видео

демонстрации

тук

-

[4]https://youtube.com/@ddanchev и моя журнал тук - [5]https://ddanchev.blogspot.com демонстрация за наученото тук - [6]https://archive.org/download/dancho-danchev-cyber-threat-actors-analys is-2021-2/Dancho _Danchev _Cyber _Threat _Actors _Analysis _2021-2.pdf както и моя мемоар на Български тук - [7]https://archive.org/download/danchodanchev-kiber-razuznavane-audio-kn

iga-01-memoar/Dancho

_Danchev

_Kiber

_Razuz-

navane _Memoar _02.pdf както и видео от последния Cyber Security Talks Bulgaria -

[8]https://archive.org/download/dancho-danchev-cyber-security-talks-bulga ria-2022-video-presentation-01/Dancho _Danchev _Cyber _Security _Talks _Bulgaria _2022 _Video _Presen-1016

tation _01.mp4 както и всички мой презентации тук - [9]https://archive.org/details/rsa-europe-presentation-01 както и всички мои практически анализи на кибер атали за моя

работодател тук - [10]https://archive.org/details/dancho-danchev-whois-xml-api-maltego-bull etproof-infrastructure-2

Примерния курс за OSINT обучение които предлагам включва:

• Достигане до Източника на Кибер Атаката По Време на Анализа на Информация с

Публични Източници

• Използване на Разузнаване на Информация с Публични Източници в анализа на кибер

атаки

• Използване на Разузнаване на Информация с Публични Източници в борбата с

престъпленията

• Кои е Данчо Данчев?

• Кои са някой от текущите ми и бъдещи проекти в сферата?

• Обогатяване на информацията по време на Анализа на Информация с Публични

Източници

• Основи на Разузнаването с Публични Източници на Информация

• Практическа Демонстрация на Анализ на Информация с Публични Източници

• Практически Примери на Анализ на Информация с Публични Източници

• Практически съвети по време на Анализа на Информация с Публични Източници

• Представяне на Курса

• Събиране на Техническа Информация по време на Анализа на Информация с Публични

Източници за Напреднали

• Събиране на Техническа Информация по време на Анализа на Информация с Публични

Източници за Начинаещи

• Тактики и Методологии за Начинаещи

• Тактики и Метотодологии за Напреднали

• Текущо състояние на пазара за продукти и услуги свързани с Разузнаване на

аИнформация с Публични Източници на Информация

• Финален Изпит и Въпроси

Пример курс по threat intelligence който предлагам включва:

• Борба с киберпрестъпността в контекста на използване на информация за заплахи

• Бъдещето на разузнаването на заплахи

• Усъвършенствани практики за разузнаване на заплахи Концепции и методологии -

Практически пример

• Въведение

• Как да използвате публични и собствени бази данни за разузнаване на заплахи

за кампании за приписване на участници в кибернетични заплахи, включително

кръстосани препратки и кръстосана проверка
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• Как да обогатите IoC за цялата си компания (индикатори за компрометиране) с

помощта на публични и собствени източници и да свържете точките при голяма

кибератака и кампания за актьор в кибернетична заплаха

• Използване на OSINT в контекста на събиране на информация за заплахи

• Изследване на киберпрестъпления и разузнаване на заплахи IoC (индикатор за

компромис) Обогатяване в контекста на използване на OSINT

• Практиката за борба с киберпрестъпленията чрез разузнаване на заплахи

• Концепции за разузнаване на заплахи за начинаещи

• Методологии за проактивно разузнаване на заплахи

• Методологии за разузнаване на заплахи

• Обогатяване на информация за заплахи в контекста на използване на OSINT

• Как да превърнете вашите клиенти в пасивни и активни разпределени сензори за

събиране на информация за заплахи?

• Основи на разузнаването на заплахи

• Разширено функциониране и поддържане на програма за разузнаване на заплахи в

цялата компания за напреднали потребители

• Практически съвети за разузнаване на заплахи

• Основите на започването на разузнаване на заплахи за начинаещи

• Разузнаване на заплахи в контекста на кибератака.

• Разузнаване на заплахите в контекста на използване на техническо събиране за атаки

с приписване на актьор на кибернетична заплаха

• Разширени концепции за разузнаване на заплахи

• Как да преобразувате крайните точки на служителите на вашата компания в

разпределен сензор за събиране на информация за пасивни и активни разузнавания

за заплахи?

• Текущо състояние на екосистемата за разузнаване на заплахи

• Текущо състояние на пазара за разузнаване на заплахи

• Наистина ли работи методологията „Агрегиране и забравяне“ в областта на

разузнаването на заплахи?

• Основите на стартирането, поддържането и управлението на програма за разузнаване

на заплахи в цялата компания за начинаещи

• Как да обучите вашите анализатори за разузнаване на заплахи да бъдат рок звезди

на индустрията за сигурност и аналитичните и технически рок звезди?

Sample video demonstration of Dancho Danchev’s OSINT and Threat Intelligence training in Bulgarian:
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In case you’re interested in inquiring about individual or group OSINT or threat intelligence training for you or for your team feel free to drop me a line at dancho.danchev@hush.com 1. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjdqHfJrWMLhCgApsiWsoIL2ocIRKCxDH0q7L5vaDxqldcia

Wvbn9Ksyg33rVQQnxRM1kPnpfePnO8kBOuJFFtc8It3Hjcgu7mHzKH

2. https://disruptive-individuals.com/wp-content/uploads/2021/11/Dancho_Danchev_CV_2021.pdf

3. https://archive.org/details/@ddanchev

4. https://youtube.com/@ddanchev

5. https://ddanchev.blogspot.com/

6.

https://archive.org/download/dancho-danchev-cyber-threat-actors-analysis-2021-2/Dancho_Danchev_Cyber_Thr

eat_Actors_Analysis_2021-2.pdf

7.

https://archive.org/download/dancho-danchev-kiber-razuznavane-audio-kniga-01-memoar/Dancho_Danchev_Kiber

_Razuznavane_Memoar_02.pdf

8.

https://archive.org/download/dancho-danchev-cyber-security-talks-bulgaria-2022-video-presentation-01/Dan

cho_Danchev_Cyber_Security_Talks_Bulgaria_2022_Video_Pre

9. https://archive.org/details/rsa-europe-presentation-01

10. https://archive.org/details/dancho-danchev-whois-xml-api-maltego-bulletproof-infrastructure-2
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1.4.5 Dancho Danchev’s OSINT and Threat Intelligence Training Video Demonstration in Bulgarian - Part One (2023-06-04 07:12)

I’ve decided to share with everyone a recently released YouTube video demonstration in Bulgarian on the topic of OSINT and threat intelligence training.

Here’s a sample Table of Contents for the OSINT and the Threat Intelligence training in Bulgarian:

Кой се интересува от индивидуално или групово обучение в сферата на OSINT анализ и

превенция на кибер престъпления и анализ и обработка на кибер атаки известен още

като практиката Threat Intelligence? Можете да видите моето CV тук -

[1]http://disruptive-individuals.com/wp-content/uploads/2021/11/Dancho _Danchev _CV

_2021.pdf портфолио от анализи и проучвания от 2005 до 2023 тук -

[2]https://archive.org/details/@ddanchev видео демонстрации тук -

[3]https://youtube.com/@ddanchev и моя журнал тук - [4]https://ddanchev.blogspot.com демонстрация за наученото тук -

[5]https://archive.org/download/dancho-danchev-cyber-threat-actors-analysis

-2021-2/Dancho _Danchev _Cyber _Threat _Actors _Analysis _2021-2.pdf както и моя мемоар

на Български тук -
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[6]https://archive.org/download/dancho-danchev-kiber-razuznavane-audio-knig a-01-memoar/Dancho _Danchev _Kiber _Razuznavane _Memoar _02.pdf както и видео от

последния Cyber Security Talks Bulgaria -

[7]https://archive.org/download/dancho-danchev-cyber-security-talks-bulgari a-2022-video-presentation-01/Dancho _Danchev _Cyber _Security _Talks _Bulgaria _2022

_Video _Presentation _01.mp4 както и всички мой презентации тук -

[8]https://archive.org/details/rsa-europe-presentation-01 както и всички мои практически

анализи на кибер атали за моя работодател тук -

[9]https://archive.org/details/dancho-danchev-whois-xml-api-maltego-bulletp roof-infrastructure-2

Примерния курс за OSINT обучение които предлагам включва:

• Достигане до Източника на Кибер Атаката По Време на Анализа на Информация с

Публични Източници

• Използване на Разузнаване на Информация с Публични Източници в анализа на кибер

атаки

• Използване на Разузнаване на Информация с Публични Източници в борбата с

престъпленията

• Кои е Данчо Данчев?

• Кои са някой от текущите ми и бъдещи проекти в сферата?

• Обогатяване на информацията по време на Анализа на Информация с Публични

Източници

• Основи на Разузнаването с Публични Източници на Информация

• Практическа Демонстрация на Анализ на Информация с Публични Източници

• Практически Примери на Анализ на Информация с Публични Източници

• Практически съвети по време на Анализа на Информация с Публични Източници

• Представяне на Курса

• Събиране на Техническа Информация по време на Анализа на Информация с Публични

Източници за Напреднали

• Събиране на Техническа Информация по време на Анализа на Информация с Публични

Източници за Начинаещи

• Тактики и Методологии за Начинаещи

• Тактики и Метотодологии за Напреднали

• Текущо състояние на пазара за продукти и услуги свързани с Разузнаване на

аИнформация с Публични Източници на Информация

• Финален Изпит и Въпроси

Пример курс по threat intelligence който предлагам включва:

• Борба с киберпрестъпността в контекста на използване на информация за заплахи

• Бъдещето на разузнаването на заплахи

• Усъвършенствани практики за разузнаване на заплахи Концепции и методологии -

Практически пример
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• Въведение

• Как да използвате публични и собствени бази данни за разузнаване на заплахи

за кампании за приписване на участници в кибернетични заплахи, включително

кръстосани препратки и кръстосана проверка

• Как да обогатите IoC за цялата си компания (индикатори за компрометиране) с

помощта на публични и собствени източници и да свържете точките при голяма

кибератака и кампания за актьор в кибернетична заплаха

• Използване на OSINT в контекста на събиране на информация за заплахи

• Изследване на киберпрестъпления и разузнаване на заплахи IoC (индикатор за

компромис) Обогатяване в контекста на използване на OSINT

• Практиката за борба с киберпрестъпленията чрез разузнаване на заплахи

• Концепции за разузнаване на заплахи за начинаещи

• Методологии за проактивно разузнаване на заплахи

• Методологии за разузнаване на заплахи

• Обогатяване на информация за заплахи в контекста на използване на OSINT

• Как да превърнете вашите клиенти в пасивни и активни разпределени сензори за

събиране на информация за заплахи?

• Основи на разузнаването на заплахи

• Разширено функциониране и поддържане на програма за разузнаване на заплахи в

цялата компания за напреднали потребители

• Практически съвети за разузнаване на заплахи

• Основите на започването на разузнаване на заплахи за начинаещи

• Разузнаване на заплахи в контекста на кибератака.

• Разузнаване на заплахите в контекста на използване на техническо събиране за атаки

с приписване на актьор на кибернетична заплаха

• Разширени концепции за разузнаване на заплахи

• Как да преобразувате крайните точки на служителите на вашата компания в

разпределен сензор за събиране на информация за пасивни и активни разузнавания

за заплахи?

• Текущо състояние на екосистемата за разузнаване на заплахи

• Текущо състояние на пазара за разузнаване на заплахи

• Наистина ли работи методологията „Агрегиране и забравяне“ в областта на

разузнаването на заплахи?

• Основите на стартирането, поддържането и управлението на програма за разузнаване

на заплахи в цялата компания за начинаещи

• Как да обучите вашите анализатори за разузнаване на заплахи да бъдат рок звезди

на индустрията за сигурност и аналитичните и технически рок звезди?

Sample video demonstration of Dancho Danchev’s OSINT and Threat Intelligence training in Bulgarian:
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In case you’re interested in inquiring about individual or group OSINT or threat intelligence training for you or for your team feel free to drop me a line at dancho.danchev@hush.com 1. https://disruptive-individuals.com/wp-content/uploads/2021/11/Dancho_Danchev_CV_2021.pdf

2. https://archive.org/details/@ddanchev

3. https://youtube.com/@ddanchev

4. https://ddanchev.blogspot.com/

5.

https://archive.org/download/dancho-danchev-cyber-threat-actors-analysis-2021-2/Dancho_Danchev_Cyber_Thr

eat_Actors_Analysis_2021-2.pdf

6.

https://archive.org/download/dancho-danchev-kiber-razuznavane-audio-kniga-01-memoar/Dancho_Danchev_Kiber

_Razuznavane_Memoar_02.pdf

7.

https://archive.org/download/dancho-danchev-cyber-security-talks-bulgaria-2022-video-presentation-01/Dan

cho_Danchev_Cyber_Security_Talks_Bulgaria_2022_Video_Pre

8. https://archive.org/details/rsa-europe-presentation-01

9. https://archive.org/details/dancho-danchev-whois-xml-api-maltego-bulletproof-infrastructure-2

1.4.6 Dancho Danchev’s OSINT Introduction Training Video Demonstration in Bulgarian - Part Three (2023-06-05 01:11)

[1]
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I’ve decided to share with everyone a recently released YouTube video demonstration in Bulgarian on the topic of OSINT and threat intelligence training.

Here’s a sample Table of Contents for the OSINT and the Threat Intelligence training in Bulgarian:

Кой се интересува от индивидуално или групово обучение в сферата на OSINT анализ и

превенция на кибер престъпления и анализ и обработка на кибер атаки известен още

като практиката Threat Intelligence? Можете да видите моето CV тук -

[2]http://disruptive-individuals.com/wp-content/uploads/2021/11/Dancho _Danchev _CV

_2021.pdf портфолио от анализи и проучвания от 2005 до 2023 тук -

[3]https://archive.org/details/@ddanchev видео демонстрации тук -

[4]https://youtube.com/@ddanchev и моя журнал тук - [5]https://ddanchev.blogspot.com демонстрация за наученото тук -

[6]https://archive.org/download/dancho-danchev-cyber-threat-actors-analys is-2021-2/Dancho _Danchev _Cyber _Threat _Actors _Analysis _2021-2.pdf както и моя

мемоар на Български тук -

[7]https://archive.org/download/dancho-danchev-kiber-razuznavane-audio-kn iga-01-memoar/Dancho _Danchev _Kiber _Razuznavane _Memoar _02.pdf както и видео от

последния Cyber Security Talks Bulgaria -

[8]https://archive.org/download/dancho-danchev-cyber-security-talks-bulga ria-2022-video-presentation-01/Dancho _Danchev _Cyber _Security _Talks _Bulgaria _2022
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_Video _Presentation _01.mp4 както и всички мой презентации тук -

[9]https://archive.org/details/rsa-europe-presentation-01 както и всички мои практически

анализи на кибер атали за моя работодател тук -

[10]https://archive.org/details/dancho-danchev-whois-xml-api-maltego-bull etproof-infrastructure-2

Примерния курс за OSINT обучение които предлагам включва:

• Достигане до Източника на Кибер Атаката По Време на Анализа на Информация с

Публични Източници

• Използване на Разузнаване на Информация с Публични Източници в анализа на кибер

атаки

• Използване на Разузнаване на Информация с Публични Източници в борбата с

престъпленията

• Кои е Данчо Данчев?

• Кои са някой от текущите ми и бъдещи проекти в сферата?

• Обогатяване на информацията по време на Анализа на Информация с Публични

Източници

• Основи на Разузнаването с Публични Източници на Информация

• Практическа Демонстрация на Анализ на Информация с Публични Източници

• Практически Примери на Анализ на Информация с Публични Източници

• Практически съвети по време на Анализа на Информация с Публични Източници

• Представяне на Курса

• Събиране на Техническа Информация по време на Анализа на Информация с Публични

Източници за Напреднали

• Събиране на Техническа Информация по време на Анализа на Информация с Публични

Източници за Начинаещи

• Тактики и Методологии за Начинаещи

• Тактики и Метотодологии за Напреднали

• Текущо състояние на пазара за продукти и услуги свързани с Разузнаване на

аИнформация с Публични Източници на Информация

• Финален Изпит и Въпроси

Пример курс по threat intelligence който предлагам включва:

• Борба с киберпрестъпността в контекста на използване на информация за заплахи

• Бъдещето на разузнаването на заплахи

• Усъвършенствани практики за разузнаване на заплахи Концепции и методологии -

Практически пример

• Въведение

• Как да използвате публични и собствени бази данни за разузнаване на заплахи

за кампании за приписване на участници в кибернетични заплахи, включително

кръстосани препратки и кръстосана проверка
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• Как да обогатите IoC за цялата си компания (индикатори за компрометиране) с

помощта на публични и собствени източници и да свържете точките при голяма

кибератака и кампания за актьор в кибернетична заплаха

• Използване на OSINT в контекста на събиране на информация за заплахи

• Изследване на киберпрестъпления и разузнаване на заплахи IoC (индикатор за

компромис) Обогатяване в контекста на използване на OSINT

• Практиката за борба с киберпрестъпленията чрез разузнаване на заплахи

• Концепции за разузнаване на заплахи за начинаещи

• Методологии за проактивно разузнаване на заплахи

• Методологии за разузнаване на заплахи

• Обогатяване на информация за заплахи в контекста на използване на OSINT

• Как да превърнете вашите клиенти в пасивни и активни разпределени сензори за

събиране на информация за заплахи?

• Основи на разузнаването на заплахи

• Разширено функциониране и поддържане на програма за разузнаване на заплахи в

цялата компания за напреднали потребители

• Практически съвети за разузнаване на заплахи

• Основите на започването на разузнаване на заплахи за начинаещи

• Разузнаване на заплахи в контекста на кибератака.

• Разузнаване на заплахите в контекста на използване на техническо събиране за атаки

с приписване на актьор на кибернетична заплаха

• Разширени концепции за разузнаване на заплахи

• Как да преобразувате крайните точки на служителите на вашата компания в

разпределен сензор за събиране на информация за пасивни и активни разузнавания

за заплахи?

• Текущо състояние на екосистемата за разузнаване на заплахи

• Текущо състояние на пазара за разузнаване на заплахи

• Наистина ли работи методологията „Агрегиране и забравяне“ в областта на

разузнаването на заплахи?

• Основите на стартирането, поддържането и управлението на програма за разузнаване

на заплахи в цялата компания за начинаещи

• Как да обучите вашите анализатори за разузнаване на заплахи да бъдат рок звезди

на индустрията за сигурност и аналитичните и технически рок звезди?

Sample video demonstration of Dancho Danchev’s OSINT and Threat Intelligence training in Bulgarian:
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In case you’re interested in inquiring about individual or group OSINT or threat intelligence training for you or for your team feel free to drop me a line at dancho.danchev@hush.com 1. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhrl7twjPlykxpSqJqKPfcnw5VeZWtV_C5GhJI7m3NfVp8az

d_ZjdIwOsAnEBkqvAsiWOROs3Zrm1PGYtRUCP89nDXEZSB6Wn0xgxJ

2. https://disruptive-individuals.com/wp-content/uploads/2021/11/Dancho_Danchev_CV_2021.pdf

3. https://archive.org/details/@ddanchev

4. https://youtube.com/@ddanchev

5. https://ddanchev.blogspot.com/

6.

https://archive.org/download/dancho-danchev-cyber-threat-actors-analysis-2021-2/Dancho_Danchev_Cyber_Thr

eat_Actors_Analysis_2021-2.pdf

7.

https://archive.org/download/dancho-danchev-kiber-razuznavane-audio-kniga-01-memoar/Dancho_Danchev_Kiber

_Razuznavane_Memoar_02.pdf

8.

https://archive.org/download/dancho-danchev-cyber-security-talks-bulgaria-2022-video-presentation-01/Dan

cho_Danchev_Cyber_Security_Talks_Bulgaria_2022_Video_Pre

9. https://archive.org/details/rsa-europe-presentation-01

10. https://archive.org/details/dancho-danchev-whois-xml-api-maltego-bulletproof-infrastructure-2

1.4.7 Dancho Danchev’s OSINT Introduction Training Video Demonstration in Bulgarian - Part Two (2023-06-05 01:11)

[1]
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I’ve decided to share with everyone a recently released YouTube video demonstration in Bulgarian on the topic of OSINT and threat intelligence training.

Here’s a sample Table of Contents for the OSINT and the Threat Intelligence training in Bulgarian:

Кой се интересува от индивидуално или групово обучение в сферата на OSINT анализ и

превенция на кибер престъпления и анализ и обработка на кибер атаки известен още

като практиката Threat Intelligence? Можете да видите моето CV тук -

[2]http://disruptive-individuals.com/wp-content/uploads/2021/11/Dancho _Danchev _CV

_2021.pdf портфолио от анализи и проучвания от 2005 до 2023 тук -

[3]https://archive.org/details/@ddanchev видео демонстрации тук -

[4]https://youtube.com/@ddanchev и моя журнал тук - [5]https://ddanchev.blogspot.com демонстрация за наученото тук -

[6]https://archive.org/download/dancho-danchev-cyber-threat-actors-analys is-2021-2/Dancho _Danchev _Cyber _Threat _Actors _Analysis _2021-2.pdf както и моя

мемоар на Български тук -

[7]https://archive.org/download/dancho-danchev-kiber-razuznavane-audio-kn iga-01-memoar/Dancho _Danchev _Kiber _Razuznavane _Memoar _02.pdf както и видео от

последния Cyber Security Talks Bulgaria -

[8]https://archive.org/download/dancho-danchev-cyber-security-talks-bulga ria-2022-video-presentation-01/Dancho _Danchev _Cyber _Security _Talks _Bulgaria _2022
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_Video _Presentation _01.mp4 както и всички мой презентации тук -

[9]https://archive.org/details/rsa-europe-presentation-01 както и всички мои практически

анализи на кибер атали за моя работодател тук -

[10]https://archive.org/details/dancho-danchev-whois-xml-api-maltego-bull etproof-infrastructure-2

Примерния курс за OSINT обучение които предлагам включва:

• Достигане до Източника на Кибер Атаката По Време на Анализа на Информация с

Публични Източници

• Използване на Разузнаване на Информация с Публични Източници в анализа на кибер

атаки

• Използване на Разузнаване на Информация с Публични Източници в борбата с

престъпленията

• Кои е Данчо Данчев?

• Кои са някой от текущите ми и бъдещи проекти в сферата?

• Обогатяване на информацията по време на Анализа на Информация с Публични

Източници

• Основи на Разузнаването с Публични Източници на Информация

• Практическа Демонстрация на Анализ на Информация с Публични Източници

• Практически Примери на Анализ на Информация с Публични Източници

• Практически съвети по време на Анализа на Информация с Публични Източници

• Представяне на Курса

• Събиране на Техническа Информация по време на Анализа на Информация с Публични

Източници за Напреднали

• Събиране на Техническа Информация по време на Анализа на Информация с Публични

Източници за Начинаещи

• Тактики и Методологии за Начинаещи

• Тактики и Метотодологии за Напреднали

• Текущо състояние на пазара за продукти и услуги свързани с Разузнаване на

аИнформация с Публични Източници на Информация

• Финален Изпит и Въпроси

Пример курс по threat intelligence който предлагам включва:

• Борба с киберпрестъпността в контекста на използване на информация за заплахи

• Бъдещето на разузнаването на заплахи

• Усъвършенствани практики за разузнаване на заплахи Концепции и методологии -

Практически пример

• Въведение

• Как да използвате публични и собствени бази данни за разузнаване на заплахи

за кампании за приписване на участници в кибернетични заплахи, включително

кръстосани препратки и кръстосана проверка
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• Как да обогатите IoC за цялата си компания (индикатори за компрометиране) с

помощта на публични и собствени източници и да свържете точките при голяма

кибератака и кампания за актьор в кибернетична заплаха

• Използване на OSINT в контекста на събиране на информация за заплахи

• Изследване на киберпрестъпления и разузнаване на заплахи IoC (индикатор за

компромис) Обогатяване в контекста на използване на OSINT

• Практиката за борба с киберпрестъпленията чрез разузнаване на заплахи

• Концепции за разузнаване на заплахи за начинаещи

• Методологии за проактивно разузнаване на заплахи

• Методологии за разузнаване на заплахи

• Обогатяване на информация за заплахи в контекста на използване на OSINT

• Как да превърнете вашите клиенти в пасивни и активни разпределени сензори за

събиране на информация за заплахи?

• Основи на разузнаването на заплахи

• Разширено функциониране и поддържане на програма за разузнаване на заплахи в

цялата компания за напреднали потребители

• Практически съвети за разузнаване на заплахи

• Основите на започването на разузнаване на заплахи за начинаещи

• Разузнаване на заплахи в контекста на кибератака.

• Разузнаване на заплахите в контекста на използване на техническо събиране за атаки

с приписване на актьор на кибернетична заплаха

• Разширени концепции за разузнаване на заплахи

• Как да преобразувате крайните точки на служителите на вашата компания в

разпределен сензор за събиране на информация за пасивни и активни разузнавания

за заплахи?

• Текущо състояние на екосистемата за разузнаване на заплахи

• Текущо състояние на пазара за разузнаване на заплахи

• Наистина ли работи методологията „Агрегиране и забравяне“ в областта на

разузнаването на заплахи?

• Основите на стартирането, поддържането и управлението на програма за разузнаване

на заплахи в цялата компания за начинаещи

• Как да обучите вашите анализатори за разузнаване на заплахи да бъдат рок звезди

на индустрията за сигурност и аналитичните и технически рок звезди?

Sample video demonstration of Dancho Danchev’s OSINT and Threat Intelligence training in Bulgarian:
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In case you’re interested in inquiring about individual or group OSINT or threat intelligence training for you or for your team feel free to drop me a line at dancho.danchev@hush.com 1. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhu-OH-fbhdQghWkUc2uDFsZ0mzChOfcOKkLSzgd7dS0Ggrc

xSubW6XHmquwKSuobbsOnndra7XslnVejti2ekukoS2jsZwslkGylF

2. https://disruptive-individuals.com/wp-content/uploads/2021/11/Dancho_Danchev_CV_2021.pdf

3. https://archive.org/details/@ddanchev

4. https://youtube.com/@ddanchev

5. https://ddanchev.blogspot.com/

6.

https://archive.org/download/dancho-danchev-cyber-threat-actors-analysis-2021-2/Dancho_Danchev_Cyber_Thr

eat_Actors_Analysis_2021-2.pdf

7.

https://archive.org/download/dancho-danchev-kiber-razuznavane-audio-kniga-01-memoar/Dancho_Danchev_Kiber

_Razuznavane_Memoar_02.pdf

8.

https://archive.org/download/dancho-danchev-cyber-security-talks-bulgaria-2022-video-presentation-01/Dan

cho_Danchev_Cyber_Security_Talks_Bulgaria_2022_Video_Pre

9. https://archive.org/details/rsa-europe-presentation-01

10. https://archive.org/details/dancho-danchev-whois-xml-api-maltego-bulletproof-infrastructure-2

1.4.8 Dancho Danchev’s OSINT Introduction Training Video Demonstration in Bulgarian - Part One (2023-06-05 01:11)

[1]
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I’ve decided to share with everyone a recently released YouTube video demonstration in Bulgarian on the topic of OSINT and threat intelligence training.

Here’s a sample Table of Contents for the OSINT and the Threat Intelligence training in Bulgarian:

Кой се интересува от индивидуално или групово обучение в сферата на OSINT анализ и

превенция на кибер престъпления и анализ и обработка на кибер атаки известен още

като практиката Threat Intelligence? Можете да видите моето CV тук -

[2]http://disruptive-individuals.com/wp-content/uploads/2021/11/Dancho _Danchev _CV

_2021.pdf портфолио от анализи и проучвания от 2005 до 2023 тук -

[3]https://archive.org/details/@ddanchev видео демонстрации тук -

[4]https://youtube.com/@ddanchev и моя журнал тук - [5]https://ddanchev.blogspot.com демонстрация за наученото тук -

[6]https://archive.org/download/dancho-danchev-cyber-threat-actors-analys is-2021-2/Dancho _Danchev _Cyber _Threat _Actors _Analysis _2021-2.pdf както и моя

мемоар на Български тук -

[7]https://archive.org/download/dancho-danchev-kiber-razuznavane-audio-kn iga-01-memoar/Dancho _Danchev _Kiber _Razuznavane _Memoar _02.pdf както и видео от

последния Cyber Security Talks Bulgaria -

1032

[8]https://archive.org/download/dancho-danchev-cyber-security-talks-bulga ria-2022-video-presentation-01/Dancho _Danchev _Cyber _Security _Talks _Bulgaria _2022

_Video _Presentation _01.mp4 както и всички мой презентации тук -

[9]https://archive.org/details/rsa-europe-presentation-01 както и всички мои практически

анализи на кибер атали за моя работодател тук -

[10]https://archive.org/details/dancho-danchev-whois-xml-api-maltego-bull etproof-infrastructure-2

Примерния курс за OSINT обучение които предлагам включва:

• Достигане до Източника на Кибер Атаката По Време на Анализа на Информация с

Публични Източници

• Използване на Разузнаване на Информация с Публични Източници в анализа на кибер

атаки

• Използване на Разузнаване на Информация с Публични Източници в борбата с

престъпленията

• Кои е Данчо Данчев?

• Кои са някой от текущите ми и бъдещи проекти в сферата?

• Обогатяване на информацията по време на Анализа на Информация с Публични

Източници

• Основи на Разузнаването с Публични Източници на Информация

• Практическа Демонстрация на Анализ на Информация с Публични Източници

• Практически Примери на Анализ на Информация с Публични Източници

• Практически съвети по време на Анализа на Информация с Публични Източници

• Представяне на Курса

• Събиране на Техническа Информация по време на Анализа на Информация с Публични

Източници за Напреднали

• Събиране на Техническа Информация по време на Анализа на Информация с Публични

Източници за Начинаещи

• Тактики и Методологии за Начинаещи

• Тактики и Метотодологии за Напреднали

• Текущо състояние на пазара за продукти и услуги свързани с Разузнаване на

аИнформация с Публични Източници на Информация

• Финален Изпит и Въпроси

Пример курс по threat intelligence който предлагам включва:

• Борба с киберпрестъпността в контекста на използване на информация за заплахи

• Бъдещето на разузнаването на заплахи

• Усъвършенствани практики за разузнаване на заплахи Концепции и методологии -

Практически пример

• Въведение

• Как да използвате публични и собствени бази данни за разузнаване на заплахи

за кампании за приписване на участници в кибернетични заплахи, включително

кръстосани препратки и кръстосана проверка
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• Как да обогатите IoC за цялата си компания (индикатори за компрометиране) с

помощта на публични и собствени източници и да свържете точките при голяма

кибератака и кампания за актьор в кибернетична заплаха

• Използване на OSINT в контекста на събиране на информация за заплахи

• Изследване на киберпрестъпления и разузнаване на заплахи IoC (индикатор за

компромис) Обогатяване в контекста на използване на OSINT

• Практиката за борба с киберпрестъпленията чрез разузнаване на заплахи

• Концепции за разузнаване на заплахи за начинаещи

• Методологии за проактивно разузнаване на заплахи

• Методологии за разузнаване на заплахи

• Обогатяване на информация за заплахи в контекста на използване на OSINT

• Как да превърнете вашите клиенти в пасивни и активни разпределени сензори за

събиране на информация за заплахи?

• Основи на разузнаването на заплахи

• Разширено функциониране и поддържане на програма за разузнаване на заплахи в

цялата компания за напреднали потребители

• Практически съвети за разузнаване на заплахи

• Основите на започването на разузнаване на заплахи за начинаещи

• Разузнаване на заплахи в контекста на кибератака.

• Разузнаване на заплахите в контекста на използване на техническо събиране за атаки

с приписване на актьор на кибернетична заплаха

• Разширени концепции за разузнаване на заплахи

• Как да преобразувате крайните точки на служителите на вашата компания в

разпределен сензор за събиране на информация за пасивни и активни разузнавания

за заплахи?

• Текущо състояние на екосистемата за разузнаване на заплахи

• Текущо състояние на пазара за разузнаване на заплахи

• Наистина ли работи методологията „Агрегиране и забравяне“ в областта на

разузнаването на заплахи?

• Основите на стартирането, поддържането и управлението на програма за разузнаване

на заплахи в цялата компания за начинаещи

• Как да обучите вашите анализатори за разузнаване на заплахи да бъдат рок звезди

на индустрията за сигурност и аналитичните и технически рок звезди?

Sample video demonstration of Dancho Danchev’s OSINT and Threat Intelligence training in Bulgarian:
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In case you’re interested in inquiring about individual or group OSINT or threat intelligence training for you or for your team feel free to drop me a line at dancho.danchev@hush.com 1. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjKanm7lGb6ZySkIylzx8y89g_EG9Q3NN7oDfgoGe-DJnoFG

FoxvEO9y8qCT5QlATnE4T4cOV9GEdr0EMIpnWQ9YAKjzHEoVJXiat_

2. https://disruptive-individuals.com/wp-content/uploads/2021/11/Dancho_Danchev_CV_2021.pdf

3. https://archive.org/details/@ddanchev

4. https://youtube.com/@ddanchev

5. https://ddanchev.blogspot.com/

6.

https://archive.org/download/dancho-danchev-cyber-threat-actors-analysis-2021-2/Dancho_Danchev_Cyber_Thr

eat_Actors_Analysis_2021-2.pdf

7.

https://archive.org/download/dancho-danchev-kiber-razuznavane-audio-kniga-01-memoar/Dancho_Danchev_Kiber

_Razuznavane_Memoar_02.pdf

8.

https://archive.org/download/dancho-danchev-cyber-security-talks-bulgaria-2022-video-presentation-01/Dan

cho_Danchev_Cyber_Security_Talks_Bulgaria_2022_Video_Pre

9. https://archive.org/details/rsa-europe-presentation-01

10. https://archive.org/details/dancho-danchev-whois-xml-api-maltego-bulletproof-infrastructure-2

1.5 July

1.5.1 Upcoming Release of a Biographical Cyber Security Visual Novel Game - Who Wants to Donate? (2023-07-07 19:55)

[1]
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Dear blog readers,

Happy summer or even better said how’s the summer in the context of having me announce my summer project which is basically a biographical Visual Novel game on which I’m working using Unity and Articy where the ultimate goal would be to present my story as a teenage hacker enthusiast throughout the 90’s up to present day where I’m a cybercrime researcher security blogger OSINT analyst and threat intelligence analyst which will consist of real-world people friends and colleagues from my online experience including colleagues and friends from the industry where my main goal would be to make this an unforgettable and educational and also mind and spirit provoking experience for everyone that I’ve work with online throughout the years.

[2]
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Special thanks to [3]Elitecy Stuart for the hard work.

Here’s a teaser:

" Cybercrime World Computer Game is an innovative and cutting-edge game that immerses players into the complex and dynamic world of cybercrimes. With its highly realistic graphics and intricate gameplay mechanics, this game provides a unique and informative experience for individuals seeking to understand the inner workings of cybercriminal activities.

Through a series of challenging missions and scenarios, players are given the opportunity to navigate through virtual environments, uncover vulnerabilities, execute sophisticated hacking techniques, and ultimately defend against potential cyber threats. The game offers a comprehensive insight into various aspects of cybercrimes like identity theft, social engineering, malware attacks, and data breaches. In addition to its entertainment value, Cybercrime World Computer Game also serves as an effective educational tool, fostering awareness about online 1037

security practices and equipping players with the knowledge required to protect themselves from real-world cyber threats. With its flawless execution and compelling narrative structure, this game sets a new standard for the intersection between gaming and cybersecurity awareness. A computer game about Dancho Danchev’s biography would offer an interactive and immersive experience, presenting players with the opportunity to explore the fascinating life of this renowned cybersecurity expert. Drawing from real-life events, the game could start by introducing players to Danchev’s early years, highlighting his passion for technology and his pivotal role in combating cybercrime. Through captivating storytelling and gameplay mechanics, players would navigate a series of levels inspired by significant milestones in Danchev’s life. They would encounter challenges that mirror his professional struggles, such as dissecting complex malware attacks or uncovering sophisticated hacking techniques.

The game could also shed light on his relentless commitment to internet safety and empha-size his active involvement in global cybersecurity initiatives. By creating a dynamic narrative centered around real-world accomplishments, this computer game would not only entertain players but also educate them about the crucial work of cybersecurity professionals like Dancho Danchev. The Cybercrime World Visual Novel Game is a captivating and thrilling gaming experience set in the dark underbelly of the digital world. This interactive story-driven game immerses players in a gripping narrative centered around cybercrime activities, where they assume the role of an aspiring hacker seeking fame and fortune within this clandestine world.

The game’s stunning visuals and realistic depiction of hacking techniques enhance the overall gaming experience, providing players with an authentic glimpse into the intricacies of cybercriminal operations. With its meticulously crafted storyline filled with unexpected plot twists and suspenseful moments, players will find themselves engrossed in a world full of danger and deceit. Moreover, the game encourages critical thinking and problem-solving skills as players navigate through intricate puzzles, bypass security systems, and outsmart rivals to ultimately emerge as a renowned "cyberlord." Undoubtedly, this innovative visual novel is poised to cap-tivate gamers who seek intrigue, challenge, and an immersive exploration into the realm of cybercrimes.

A visual novel computer game about hackers combines the immersive storytelling of visual novels with the intriguing world of cybersecurity, offering players a unique and engaging experience. This genre not only delves into the technical aspects but also explores ethical implications and personal dilemmas faced by hackers. Through thoughtfully designed narratives, players are able to grasp complex hacking techniques, learn about digital security practices, and gain insights into the motives driving these characters. The game’s attention to detail and realistic portrayal of hacking activities allows players to navigate through a wide range of scenarios, from infiltrating high-security systems to unraveling intricate conspiracies.

Moreover, this game can serve as an educational tool, promoting a broader understanding of cybersecurity concepts while entertaining gamers with its captivating plotlines. Ultimately, a visual novel computer game about hackers offers a professional yet thrilling experience for both technology enthusiasts and those seeking to expand their knowledge in this ever-evolving field. "

Sample screenshots include:

[4]
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[5]

[6]

[7]
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So here’s the news? Who wants to sponsor me for this project and for its release in a timely manner preferably before the end of the summer? It would be really great if you’re an organization or a vendor where I’m full of ideas in terms of how I can give proper credit for your donation or sponsorship.

Drop me a line at dancho.danchev@hush.com in case you’re interested in sponsoring my project or in case you might have any ideas on terms of how you can contribute here such as for instance a Unity developer or a game script writer.

Stay tuned!

1. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjtW3WcctQdfQaKCPseolq9gY0miFNCBmRAQFq0D4BFJXPvg

Etn5PdYU2_F5ZZCAR_ZjszfTUrzEQXZp5L7Gz0a8BO1lI5r4zuXF3W

2. https://blogger.googleusercontent.com/img/a/AVvXsEhtXfij_stSQb8pjazdMtCsMs-9J2Y_vuiXmv1aUaBuJfXG-IHfOPfewl

xOx5AJ73uRBBdMgJzyR4OySdYQM-SetGobCo_jPeRTbK8ojqL5znXQ

3. https://www.facebook.com/profile.php?id=100088482332570

4. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi7xlMxgj82XpVodfHYmTZjv6Lwg276zYhps3WL8t16SsASF

huvRiaqbjfxeGIJCGyiNacAAYOv5DQnpvCW0ODIt3KeEXiVD4GOpjH

5. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjI-n1z61ODUYLjxLiAf2SWWEbmmIXFcdl1cZ1Ozp7naziSq

tanJ-e6FjOASbJs9i59E8sVa4qSzhJ258ITExOJxsEScOlJjjmhQPD

6. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiIw0u2gy4GbVEf1G2GYqtNShzURIjjR70RBkFSVMl9l3bUh

yKIetFldVMoqlq_yKyO8DAoq1N7H4B_3d3H9C4731_Wjn6oBN40KFa

7. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjrgxvNOBDNhwstvzfxsB9W91olxi4wQDxiZ4r6Q0-u1qcO2

4WkZazH0gtL4i9s2xhulLfk1D0WdQqBhyZXIgjxLLz5Lo1QusrcmbU
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1.5.2 Who’s on Wikipedia? (2023-07-20 12:00)

Dear blog readers,

Who’s on Wikipedia is an Editor or can forward [1]this to their friends on Wikipedia?

[2]

It’s a [3]Draft about me and my experience in the field which you can assist in Editing and contributing to using a set of [4]links and resources which I’ve prepared including to assist in adding references from [5]Google Books and [6]Google Scholar.

Stay tuned.

1. https://en.wikipedia.org/wiki/Draft:Dancho_Danchev

2. https://blogger.googleusercontent.com/img/a/AVvXsEiuVkgO1iMaIeo9hfGC0jS3rFRXh88cl8-LWmFieY1J687BEyaSVX65wE
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4WfYMA8DQmx-uPgHupTJriFgZLk0ThLZHWjypMAauhJi7KML7jS0kC

3. https://en.wikipedia.org/wiki/Draft:Dancho_Danchev

4. https://drive.google.com/file/d/1a9_OsaAOjLkzMotmATemMvUagYPoBYuk/view?usp=drivesdk

5. https://www.google.com/search?tbm=bks&q=%2522dancho+danchev%2522

6. https://scholar.google.com/scholar?hl=en&as_sdt=0%252C5&q=%2522dancho+danchev%2522&btnG=&oq=

1.5.3 Exposing the Internet-Connected Infrastructure of FBI’s Most Wanted Igor Dehtyarchuk - "Floraby" - An OSINT Analysis (2023-07-25 14:54)

[1]

Dear blog readers,

I’ve decided to share some actionable intelligence on the Internet-connected infrastructure of FBI’s Most Wanted - [2]Igor Dehtyarchuk - "Floraby" with the idea to assist everyone doing 1042

research on the topic including U.S Law Enforcement on its way to track down and monitor this individual and his associated Internet-connected properties.

Sample emails known to have been involved in the campaign include: abuse@shopsn.su

dimetr801@mail.ru

admin@4server.su

ssg.apple77@gmail.com

Sample domains known to have been involved in the campaign include: 4server.su

csgoacc.ru

marketsales.su

zarmo.su

4domains.su

ebayshop.su

globus-base.su

broshop.su

deer.su

shopsn.su

cjmarket.net

vkaccounts.com

cheapaccounts.su

ytuber.su

vds4u.su

4host.su

tgshop.su

xn–227-qdd4dec.xn–p1acf

4dedic.su

time-hack.su

4ns.su

Sample screenshot:

[3]
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Stay tuned!

1. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj85uNWPxkQrktIOGAU0J9qUfDyRoMEplQV2JNxHLWfD8ql8

a41xSNcM7x_s3Y_HscY3gHKqobnDqHWcTJ-xNAEny17zKsZj37EO99

2. https://www.fbi.gov/wanted/cyber/igor-dekhtyarchuk

3. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi9S_buJXZAq8DtvWo7BiL45vXRrL3KEGOvAy4AGvCtrOhIc

TYG9z1514yKMIgd8i1YzNvWmhyFFnaAG6j8haTIqC3cTll7vtMtXwG

1.5.4 Dancho Danchev’s Disappearance - 2010 - Official Complaint Against Republic of Bulgaria Regarding Dancho Danchev’s Illegal Law Enforcement Arrest Home Molestation and Kidnapping Attempt - A Compilation - Part Two (2023-07-27 23:22)

[1]

[2]Define: peasant forgetting the true reality of non-existence in the universal wannabe 1044





agricultural economy referred to as the very bottom of Eastern Europe.

The following is yet another official complaint part of the compilation of official complaints for the exact same people that kidnapped me from my place back in 2010 with my stolen ID which resulted in illegal detention for four months without anyone knowing and without any sort of explanation up to present day for which I warned in advance and $85,000 later which I legally earned and lost due to home molestation and on purpose drug poisoning courtesy of Bulgaria’s DANS agency in combination with local peasants and savages from Bulgarian Law Enforcement from the city of Troyan, Bulgaria which is my hometown.

Whether it’s through modest complaints or through other means I promise that I will do my best to shed more light and continue elaborating more on this case from Bulgaria and three and five years and $85,000 legally earned and lost due to on purpose poisoning through other means other than this case of supreme idiocity and easy to detect and spot local degree of idiocity and peasant-eria with no explanation up to present day.

Is it a bottom is it a bottom line or is it the bottom line in the very bottom line of yours? I promise that I’ll soon take the time and effort and elaborate in-depth on the degree of savagery and moronic – apologies there’s no such word when it comes to my hometown – peasantaria and idiocy of the people living in my hometown Troyan, Bulgaria including the very bottom of what’s invisible to others in the true spirit of what some others would describe as something that I won’t tell you which is guess what – it’s the very bottom of Eastern Europe.

Whether it’s behold yourself to the almighty savior I’m not your savior or behold your almighty savior person and the very bottom of the dipshits that "make it happen" at their place every night are going to truly regret it using legal means or at the end we are going to find you a decent place buy it so that you can rent it and eventually for the blessing of everyone that truly knows you commit suicide in the true spirit of spending the irrelevance of your existence where it belongs in the place that we bought and that you rented and where you committed suicide or in the other place where all of your relatives belong. I won’t say but the very smells of your enticing existence tends to point to everyone’s favorite place for Bulgarian lifestyle dipshits and irrelevant to the universal irrelevance of your existence place. Guess what? That’s not my place.

1. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjJzlWJF0zDCLHoaMCxMQfYk3kOZs6wpANUraAyMuorPU8js

pRduooe7i-fbS11-9hTW_3ejqcKxFsBxnIteiukPqfFW7SfA6l5a_J

2. https://www.google.com/search?q=define%3Apeasant

1.5.5 Cyber Intelligence - Second Edition - Released (2023-07-31 02:55)

[1]
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Grab a [2]PDF or [3]ePub copy from [4]here including the full archive [5]here today.

Stay tuned!

1. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjjBkGifzLAIdPVMQu3iEqt1p2lXSc40B1PWAeUjvc5dSkdm

8JbnWlpYOcZGHGePoiLR_AwTPqLr3scpDyOIdFPR2EcwKn8RtY1-CM

2.

https://archive.org/download/dancho-danchev-cyber-intelligence-cybercrime-memoir-second-edition-2023/Dan

cho_Danchev_Cyber_Intelligence_Cybercrime_Memoir_Second_

3.

https://archive.org/download/dancho-danchev-cyber-intelligence-cybercrime-memoir-second-edition-2023/Dan

cho_Danchev_Cyber_Intelligence_Cybercrime_Memoir_Second_

4. https://archive.org/details/dancho-danchev-cyber-intelligence-cybercrime-memoir-second-edition-2023

5. https://archive.org/details/dancho-danchev-cyber-intelligence-cybercrime-memoir-second-edition-2023
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1.6 August

1.6.1 Embassy of China in Canada Issues a Statement on U.S Cyber Espionage Campaigns Against Japan (2023-08-11 22:00)

[1]

I just came across to a statement issued by the Embassy of China in Canada on the [2]U.S

cyber espionage campaigns launched against Japan.

What’s so special about this statement? First it does quite Wikileaks which is a bit of an outdated approach including the actual source to shed more light into a bigger problem and issue for China that the press statement on the Web site of the Chinese Embassy in Canada mentions. In this specific case the statement implies the use of the so called "hunt-forward"

missions which could really mean big trouble for China if the U.S somehow manages to secure a deal with a neighbouring country next to China which could really mean big trouble for China as the U.S will then attempt to establish the foundation for a successful cyber attacks and possibly information operations interception campaigns used managed and operated by China including its partners and allies where to ultimate goal would be to measure their true capabilities and set the foundation for a successful cyber situational awareness campaign in terms of cyber attacks and the true state of China’s true cyberspace operations and cyber attack capabilities including the capabilities of some of its neighbouring countries.

The so called [3]Hunt Forward Operations also known as (HFOs) are an early warning system for cyber situational awareness that could improve the true state of the visibility of the actual country that’s doing these missions in this specific case the U.S could really learn a lot about new tactics and techniques courtesy of the attackers based in the specific country where it’s hosting its mission which could be really bad news for China in terms of having the U.S deploy hunt forward missions in its neighbouring countries where the U.S could really get a better picture of China’s understanding and actual applicability of basic cyber warfare principles and concepts in action including the "know-how" of its neighbouring countries.

Despite the fact that the U.S is willing to share its knowledge and understanding of cyber attacks "know-how" with the host country of a hunt forward mission it could also learn a lot about the cyber attacks that originate from the host country and possibly improve its own situational awareness in the field including from a geographical perspective.

Happy hunting.

1. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjhtnFi-vJBN_HNbH0S5Z82cJGUUDkLbHykIhAFaDGOh5zK_

KZP415WJhemgzLA-yo2YzcyvY6r0m_NEwNlDPQO2eacChEtBSSwaXk

2. http://ca.china-embassy.gov.cn/eng/fyrth/202308/t20230810_11125180.htm

3. https://www.cybercom.mil/Media/News/Article/3218642/cyber-101-hunt-forward-operations/
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1.6.2 A Portfolio of Publicly Accessible Cybercrime Friendly Forum Communities (2023-08-11 22:01)

[1]

Who needs access to a recently collected portfolio of publicly accessible cybercrime friendly forum communities for Technical Collection and situational awareness?

I recently spend some time doing my homework on the topic in terms of improving my Cybercrime Forum Data Set and I decided to share the findings with everyone.

Sample publicly accessible cybercrime-friendly forum communities include: hxxp://crdforum.cc/

hxxp://darkwebmafias.net/

hxxp://darkstash.com/

hxxp://crdpro.cc/

hxxp://www.cardingclub.net/

hxxp://www.russiancarders.se/
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hxxp://validmarket.io/

hxxp://cardingforum.cx/

hxxp://carding.sh/

hxxp://bitcarder.com

hxxp://cardingleaks.ws/

hxxp://www.verifiedcarder.net/

hxxp://www.legitcarder.ru/

hxxp://www.crdworld.com/

hxxp://cardingmafia.to/

hxxp://cardingforum.cx

hxxp://crdforum.cc

hxxp://darkstash.com

hxxp://carders.biz

hxxp://crdpro.cc

hxxp://carders.mx

hxxp://carding-forum.com

hxxp://crdclub.su

hxxp://procrd.pw

hxxp://cardmafia.cc

hxxp://cardingforum.info

hxxp://cardingleaks.ws

hxxp://darkpro.net

hxxp://crackingforum.to

hxxp://cardingworld.ru

hxxp://darkwebmafias.ws

hxxp://leetforums.ru

hxxp://legitcarders.ws

hxxp://crdcrew.cc

hxxp://prtship.pro

hxxp://verifiedcarder.net

hxxp://legitcarder.ru

hxxp://carders.zone

hxxp://drdark.ru

hxxp://darknetweb.ru

hxxp://bpcforum.ru
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hxxp://wc-club.com

hxxp://cybercarders.com

hxxp://bitorder.pw

hxxp://cardingforum.cx/

hxxp://crdpro.cc/

hxxp://darkpro.net/

hxxp://deeptor.ws/

hxxp://www.verifiedcarder.net/

hxxp://crdforum.cc/

hxxp://crdcrew.cc/

hxxp://legitcarder.ru/

hxxp://blackhatcarding.is/

hxxp://legitcarders.ws/

hxxp://leetforums.ru/

hxxp://deepwebforum.net/

hxxp://darkwebmafias.ws/

hxxp://crdclub.su/

hxxp://www.cardingworld.ru/

hxxp://russiancarder.net/

hxxp://underworldmafias.net/

http://www.cardersteam.com

hxxp://carding.work/

hxxp://cybercarders.com/

hxxp://blacknetworld.com/

http://carding.pw/

hxxp://carders.biz/

hxxp://verified.international/

hxxp://cardingfree.com/

hxxp://drdark.ru/

hxxp://shadowcarders.com/

hxxp://cardingstuff.ws/

hxxp://carders-club.com/

hxxp://sky-fraud.net/

hxxp://darkteam.su/

hxxp://trustedsellers.ws/
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hxxp://bitorder.pw/

hxxp://www.legitmafia.ws

hxxp://carding.pw/

hxxp://cardingleaks.ws/

hxxp://darkstash.com/

hxxp://www.deepwebforum.net/

hxxp://legitmafia.ws

hxxp://carders.mx/

hxxp://cardingforums.org

hxxp://procrd.pw/

hxxp://cardvilla.cc/

hxxp://cardingclub.ws/

http://www.cardersteam.com/

hxxp://darkpro.net

hxxp://carders.zone/

hxxp://www.prtship.pro/

hxxp://carding-forum.com/

hxxp://cardmafia.cc/

hxxp://cardingforum.info

hxxp://crackingforum.to/

hxxp://prtship.pro/

hxxp://darknetweb.ru/

hxxp://www.bpcforum.ru/

hxxp://wc-club.com/

Happy Technical Collection.

1. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgXLequAvEhoNXtHwGc_x5YDbr280wdpBZqDPsnXGo6FAHKw

IyqYK2OrUWGmF76S3sdQQwhJ8aSu-1xbN1BL_NzwnbbocMUaWlPgKj

1.6.3 A Portfolio of Iran-Based Hacker Groups and Lone Iran-based Hackers Personal Web Sites (2023-08-11 22:01)

[1]
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In need of a freshly collected Iran-based hacker groups and lone hacker personal Web sites?

As I did some homework on the topic of finding these I actually came across to the fact that the majority of these are located on an Iran-based hosting provider known as Persiangig.com and as I’ve decided to dig a little bit deeper I came across to and actually bothered to compile a portfolio of these Web sites which I decided to share with everyone ready here.

Sample Iran-based hacker groups and lone hacker personal Web sites include: hxxp://adibii.persiangig.com/

hxxp://ahm4d-h4cker.persiangig.com/

hxxp://ahmadbady.persiangig.com/

hxxp://alipc1.persiangig.com/

hxxp://alireza5800.persiangig.com/

hxxp://anatema.persiangig.com/
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hxxp://anax2x.persiangig.com/

hxxp://any-thing.persiangig.com/

hxxp://artacyber.persiangig.com/

hxxp://arvineasthackers.persiangig.com/

hxxp://aware.persiangig.com/

hxxp://azazel.persiangig.com/

hxxp://barfobaran.persiangig.com/

hxxp://bigb4ng.persiangig.com/

hxxp://bl4ck-hat.persiangig.com/

hxxp://blackfox.persiangig.com/

hxxp://blackice.persiangig.com/

hxxp://bulurp.persiangig.com/

hxxp://cdn.persiangig.com/

hxxp://cld.persiangig.com/

hxxp://cr4zylov3r.persiangig.com/

hxxp://danial-secret.persiangig.com/

hxxp://drtrojan.persiangig.com/

hxxp://drwxrwxrwx.persiangig.com/

hxxp://ehsan-empire.persiangig.com/

hxxp://eshak.persiangig.com/

hxxp://farbodmahini.persiangig.com/

hxxp://freezer.persiangig.com/

hxxp://fun4ir.persiangig.com/

hxxp://g3n3rall-blackhat.persiangig.com/

hxxp://goodboy3113.persiangig.com/

hxxp://h3kt0rz.persiangig.com/

hxxp://h4med.persiangig.com/

hxxp://hashorblackhat.persiangig.com/

hxxp://hesam1955.persiangig.com/

hxxp://highersense.persiangig.com/

hxxp://hiv01.persiangig.com/

hxxp://hkhmerikhi.persiangig.com/

hxxp://hushy.persiangig.com/

hxxp://i3lue.persiangig.com/

hxxp://inf3cted.persiangig.com/
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hxxp://infohooman.persiangig.com/

hxxp://irsec.persiangig.com/

hxxp://java-mesh.persiangig.com/

hxxp://jimunix.persiangig.com/

hxxp://karaji21.persiangig.com/

hxxp://kazemfdisk.persiangig.com/

hxxp://keent.persiangig.com/

hxxp://kingq8.persiangig.com/

hxxp://lahij.persiangig.com/

hxxp://lamon.persiangig.com/

hxxp://li-tex5.persiangig.com/

hxxp://lo0ord.persiangig.com/

hxxp://lordnitro.persiangig.com/

hxxp://lvl3hr.persiangig.com/

hxxp://m4hd1.persiangig.com/

hxxp://mahdi45.persiangig.com/

hxxp://mamd00.persiangig.com/

hxxp://matin021.persiangig.com/

hxxp://medl01.persiangig.com/

hxxp://mefile.persiangig.com/

hxxp://mehdi456.persiangig.com/

hxxp://mehdy007.persiangig.com/

hxxp://mehran4u.persiangig.com/

hxxp://motakhases.persiangig.com/

hxxp://mr-bami.persiangig.com/

hxxp://mr-emiter.persiangig.com/

hxxp://mrzero.persiangig.com/

hxxp://mx7xx.persiangig.com/

hxxp://noter.persiangig.com/

hxxp://omid3r.persiangig.com/

hxxp://optishock.persiangig.com/

hxxp://ra-ha.persiangig.com/

hxxp://rad1c4l.persiangig.com/

hxxp://rebell.persiangig.com/

hxxp://rking.persiangig.com/
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hxxp://s2z2m.persiangig.com/

hxxp://saeed-00x.persiangig.com/

hxxp://saiedsoft.persiangig.com/

hxxp://security-team.persiangig.com/

hxxp://sit11.persiangig.com/

hxxp://spackt0re.persiangig.com/

hxxp://thr3at.persiangig.com/

hxxp://titaksecteam.persiangig.com/

hxxp://vampire-diaries.persiangig.com/

hxxp://veron.persiangig.com/

hxxp://virtualuniversityofshiraz.persiangig.com/

hxxp://virus45.persiangig.com/

hxxp://w00rm.persiangig.com/

hxxp://w3bbaz.persiangig.com/

hxxp://wanted1.persiangig.com/

hxxp://wantedst.persiangig.com/

hxxp://webzzz.persiangig.com/

hxxp://aamahmoodi.persiangig.com/

hxxp://abiposhan.persiangig.com/

hxxp://adonia.persiangig.com/

hxxp://ahmadgeo.persiangig.com/

hxxp://ahwazdownload.persiangig.com/

hxxp://armaninvisible.persiangig.com/

hxxp://armintanha.persiangig.com/

hxxp://azuitsociety.persiangig.com/

hxxp://backpacker.persiangig.com/

hxxp://barzan.persiangig.com/

hxxp://bergissub.persiangig.com/

hxxp://bl4ckl0rd.persiangig.com/

hxxp://capitanmsf.persiangig.com/

hxxp://countalireza.persiangig.com/

hxxp://dade1496.persiangig.com/

hxxp://defcon.persiangig.com/

hxxp://devilinside.persiangig.com/

hxxp://diazpame10.persiangig.com/
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hxxp://djmehrab.persiangig.com/

hxxp://dl-myismailyk.persiangig.com/

hxxp://dondiego.persiangig.com/

hxxp://emperor.persiangig.com/

hxxp://eshraq.persiangig.com/

hxxp://essaji.persiangig.com/

hxxp://ezdaha.persiangig.com/

hxxp://ferancesco.persiangig.com/

hxxp://firebaxe.persiangig.com/

hxxp://geneticz.persiangig.com/

hxxp://ghorube-deltangi.persiangig.com/

hxxp://goldtrader.persiangig.com/

hxxp://hamedoveisi.persiangig.com/

hxxp://hax0r.persiangig.com/

hxxp://hcthemep.persiangig.com/

hxxp://hezarto.persiangig.com/

hxxp://hoodshmand.persiangig.com/

hxxp://iaump.persiangig.com/

hxxp://ice-ex1r1.persiangig.com/

hxxp://in-pc.persiangig.com/

hxxp://index.persiangig.com/

hxxp://j-ghahraman.persiangig.com/

hxxp://j00lbak-j00mj00me.persiangig.com/

hxxp://jaylan.persiangig.com/

hxxp://kamy4r.persiangig.com/

hxxp://kangan.persiangig.com/

hxxp://liveblack.persiangig.com/

hxxp://lockheed.persiangig.com/

hxxp://lordgame2.persiangig.com/

hxxp://loveskaraj.persiangig.com/

hxxp://mfoxihst.persiangig.com/

hxxp://millad.persiangig.com/

hxxp://mohammad2050.persiangig.com/

hxxp://mr-shayan2.persiangig.com/

hxxp://n-e-o.persiangig.com/
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hxxp://niceman.persiangig.com/

hxxp://omidvar8943.persiangig.com/

hxxp://oomarshal.persiangig.com/

hxxp://paniranist.persiangig.com/

hxxp://paulauster.persiangig.com/

hxxp://pedi7khat.persiangig.com/

hxxp://pixxfa.persiangig.com/

hxxp://port80.persiangig.com/

hxxp://psychstudent.persiangig.com/

hxxp://reversecoderteam.persiangig.com/

hxxp://rkrayaneh.persiangig.com/

hxxp://robo-paraax.persiangig.com/

hxxp://saeed-trojan.persiangig.com/

hxxp://samanguner.persiangig.com/

hxxp://sarbaz-faz.persiangig.com/

hxxp://secr00t3r.persiangig.com/

hxxp://seidfmo.persiangig.com/

hxxp://shayani.persiangig.com/

hxxp://shoot.persiangig.com/

hxxp://smobasher.persiangig.com/

hxxp://sms2008.persiangig.com/

hxxp://soft91.persiangig.com/

hxxp://svvat.persiangig.com/

hxxp://syndrome.persiangig.com/

hxxp://tal-la.persiangig.com/

hxxp://terminator.persiangig.com/

hxxp://terror-hell.persiangig.com/

hxxp://un3ecure.persiangig.com/

hxxp://unicorn88.persiangig.com/

hxxp://vantil.persiangig.com/

hxxp://worlddata.persiangig.com/

hxxp://yasesefid.persiangig.com/

hxxp://zamanim.persiangig.com/

hxxp://zarmehr.persiangig.com/

hxxp://ahooeg.persiangig.com/
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hxxp://aloalo.persiangig.com/

hxxp://amir.persiangig.com/

hxxp://andisheyeziba.persiangig.com/

hxxp://ardallan.persiangig.com/

hxxp://arteshdambeldor.persiangig.com/

hxxp://behradaspik.persiangig.com/

hxxp://delsa.persiangig.com/

hxxp://deragon.persiangig.com/

hxxp://ehsun.persiangig.com/

hxxp://eldera2.persiangig.com/

hxxp://f-r-h.persiangig.com/

hxxp://faqgame.persiangig.com/

hxxp://greencity.persiangig.com/

hxxp://iceberg1990.persiangig.com/

hxxp://jegh-jeghe.persiangig.com/

hxxp://jomeegardi.persiangig.com/

hxxp://kordestan.persiangig.com/

hxxp://lol-h.persiangig.com/

hxxp://mahdi9647.persiangig.com/

hxxp://mamadi.persiangig.com/

hxxp://mamalbooter.persiangig.com/

hxxp://maroooon.persiangig.com/

hxxp://maskido.persiangig.com/

hxxp://masoudtanhha.persiangig.com/

hxxp://medrik1.persiangig.com/

hxxp://my-book31.persiangig.com/

hxxp://mycomputer89.persiangig.com/

hxxp://noclick.persiangig.com/

hxxp://package2shop.persiangig.com/

hxxp://pashang.persiangig.com/

hxxp://payam.persiangig.com/

hxxp://radmha.persiangig.com/

hxxp://sarishenasi.persiangig.com/

hxxp://shayanagent.persiangig.com/
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hxxp://lesolai.persiangig.com/

hxxp://liplipok.persiangig.com/

hxxp://m0riiii.persiangig.com/

hxxp://m0trix.persiangig.com/

hxxp://magic4.persiangig.com/

hxxp://majidnezam.persiangig.com/

hxxp://mmv1991.persiangig.com/

hxxp://mojt3b3.persiangig.com/

hxxp://mormoroth.persiangig.com/

hxxp://nbc-ashiyane.persiangig.com/

hxxp://ncoder.persiangig.com/

hxxp://nethunter.persiangig.com/

hxxp://netqq.persiangig.com/

hxxp://nimakarimi.persiangig.com/

hxxp://omidplus.persiangig.com/

hxxp://pezhmanmax2002.persiangig.com/

hxxp://pr0grammers.persiangig.com/

hxxp://pzr23.persiangig.com/

hxxp://reign.persiangig.com/

hxxp://root3r-h3ll.persiangig.com/

hxxp://root3r.persiangig.com/
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hxxp://ruin3r-ashiyane.persiangig.com/

hxxp://saber-net.persiangig.com/

hxxp://saeed006.persiangig.com/

hxxp://sevom.persiangig.com/

hxxp://shabangahweb.persiangig.com/

hxxp://sina-server1.persiangig.com/

hxxp://tntboy-001.persiangig.com/

hxxp://toopor-ir.persiangig.com/

hxxp://ven0o0s.persiangig.com/

hxxp://yahoo-bax.persiangig.com/

hxxp://air-siavash.persiangig.com/

hxxp://alibarzegar.persiangig.com/

hxxp://alimohajer.persiangig.com/

hxxp://arsalan100.persiangig.com/

hxxp://arshadguilan.persiangig.com/

hxxp://bossrasoul.persiangig.com/

hxxp://daramad14.persiangig.com/

hxxp://dinhac.persiangig.com/

hxxp://harrypotter722.persiangig.com/

hxxp://hh13570-sat.persiangig.com/

hxxp://karimzadeh.persiangig.com/

hxxp://kingofeagle.persiangig.com/

hxxp://metal200626.persiangig.com/

hxxp://miladgolnan.persiangig.com/

hxxp://milaneiran.persiangig.com/

hxxp://moejezat.persiangig.com/

hxxp://mr00798.persiangig.com/

hxxp://nn555.persiangig.com/

hxxp://p30base.persiangig.com/

hxxp://parsiblog.persiangig.com/

hxxp://playstation3.persiangig.com/

hxxp://shaji.persiangig.com/

Happy Technical Collection.

1. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi1EiNb6K3r3B1cUlIPNM6M-xRAgKs6vUbVjJ8jNMotxqia_

XPcUCJRBiFNNU27nUdg1XLsxRcdzp8LId1-j2cZhh8QpWIuHhH8v2-
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1.6.4 A Compilation of Bulletproof Hosting Provider Domains (2023-08-13 11:27)

[1]

In need of a fresh and relevant bulletproof hosting provider domain list for research purposes?

Check out the following list of domains which I compiled today and decided to share with everyone reading my blog.

Sample bulletproof hosting provider domains include:

hxxp://1984hosting.com

hxxp://2X4.ru

hxxp://2sync.co

hxxp://3nt.com

hxxp://NovoGara.com

hxxp://abusehosting.ru

hxxp://admintek.net

hxxp://advania.com

hxxp://afranet.com

hxxp://agava.ru

hxxp://albahost.net

hxxp://alexhost.com
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hxxp://altushost.com

hxxp://anders.ru

hxxp://anonymoushosting.in

hxxp://antiddos.biz

hxxp://area6.ru

hxxp://artmotion.eu

hxxp://asiapacific-it.com

hxxp://asiapacifichosting.com

hxxp://atlax.com

hxxp://availo.se

hxxp://avk-com.ru

hxxp://bacloud.com

hxxp://bahnhof.net

hxxp://balkanvps.com

hxxp://beotel.net

hxxp://berihoster.ru

hxxp://besthosting.ua

hxxp://blazingfast.io

hxxp://blueangelhost.com

hxxp://borneo.kg

hxxp://bulletproof-web.ru

hxxp://bullhost.co

hxxp://ccihosting.com

hxxp://cinipac.com

hxxp://citynethost.com

hxxp://cloud.volia.com

hxxp://cloudlite.ru

hxxp://colocall.net

hxxp://comsats.net.pk

hxxp://continent8.com

hxxp://crservers.com

hxxp://ctyun.cn

hxxp://cubexsweatherly.com

hxxp://curacaowebhosting.com

hxxp://cyberbunker.com
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hxxp://cyberfuel.com

hxxp://datacenter.ir

hxxp://datahouse.ru

hxxp://dataplugs.com

hxxp://dedicado.com.uy

hxxp://deltahost.com

hxxp://deltalis.com

hxxp://deltasystem.cl

hxxp://dis.telecom.kz

hxxp://dmzhost.c

hxxp://doclerweb.com

hxxp://dreamwebhosting.net

hxxp://ecatel.co.uk

hxxp://eccsolutions.net

hxxp://ecodissident.net

hxxp://ekvia.com

hxxp://elkupi.com

hxxp://elvsoft.com

hxxp://en.datasource.ch

hxxp://en.hostsolutions.ro

hxxp://en.ukrtelecom.ua

hxxp://en.uplink.hu

hxxp://eng.deninet.net

hxxp://eodatacenter.com

hxxp://eranet.com

hxxp://eserver.ru

hxxp://evoluso.com

hxxp://exmasters.com

hxxp://fastvds.ru

hxxp://finalhosting.cz

hxxp://firstbyte.ru

hxxp://firstvds.ru

hxxp://flokinet.is

hxxp://freehost.com.ua

hxxp://galkahost.com
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hxxp://geekhost.pro

hxxp://gemenii.ro

hxxp://glesys.com

hxxp://global.ba

hxxp://globatel.org

hxxp://gmhost.hosting

hxxp://goodnet.com.ua

hxxp://grandhost.cc

hxxp://habangnet.com

hxxp://hc.ru

hxxp://heberjahiz.com

hxxp://hidemyhost.com

hxxp://hktechnology.com

hxxp://host.al

hxxp://hostalot.ru

hxxp://hoster.ru

hxxp://hosthink.net

hxxp://hosting.nic.ru

hxxp://hosting.reg.com

hxxp://hosting.tel.ru

hxxp://hosting.tongacable.net

hxxp://hosting.turk.net

hxxp://hosting.ua

hxxp://hostingserve.rs

hxxp://hostkey.com

hxxp://hostname.cl

hxxp://hostoweb.com

hxxp://hostparatuvida.com

hxxp://hostsailor.com

hxxp://hts.ru

hxxp://hub.org

hxxp://icyevolution.com

hxxp://idhost.kz

hxxp://ihc.ru

hxxp://ihor.ru
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hxxp://infiumhost.com

hxxp://infobox.ru

hxxp://infomaniak.ch

hxxp://innovahosting.net

hxxp://insacom.cl

hxxp://internetport.com

hxxp://internetsolutions.hk

hxxp://iprosrv.com

hxxp://ironservers.cl

hxxp://ispcompania.com

hxxp://ispserver.com

hxxp://ititch.com

hxxp://itldc.com

hxxp://itools.mn

hxxp://ixam-hosting.com

hxxp://justhost.in.ua

hxxp://katzglobal.com

hxxp://knownsrv.com

hxxp://koddos.com

hxxp://kowloonhosting.com

hxxp://kras.host

hxxp://kriweb.com

hxxp://laceibanetsociety.com

hxxp://lankapartnerhost.com

hxxp://latinoserver.com

hxxp://lfait.com

hxxp://libertyvps.net

hxxp://libyanspider.com

hxxp://licosys.com

hxxp://linkdatacenter.net

hxxp://localhost.tn

hxxp://lolekhosted.net

hxxp://ltt.ly

hxxp://lunarvps.com

hxxp://lunarvps.comorangewebsite.com
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hxxp://m247.roen

hxxp://magicnet.md

hxxp://masterhost.ru

hxxp://mcloud.rs

hxxp://melbicom.net

hxxp://memvds.ru

hxxp://mikrovps.com

hxxp://mirohost.net

hxxp://mtel.ba

hxxp://mycloud.by

hxxp://nashirnet.net

hxxp://natro.com

hxxp://neoserver.ru

hxxp://netassist.ua

hxxp://netbrella.net

hxxp://netengi.com

hxxp://netplace.ru

hxxp://networksdelmanana.com

hxxp://nexlinx.net.pk

hxxp://nexus.pk

hxxp://nidahost.com

hxxp://nine.ch

hxxp://ninet.rs

hxxp://nonamehosts.com

hxxp://nplusone.ma

hxxp://nsc.ba

hxxp://oblaci.rs

hxxp://offshorededi.com

hxxp://offshoreracks.com

hxxp://ohp.ua

hxxp://ok.is

hxxp://online.tm

hxxp://orangewebsite.com

hxxp://ouriran.com

hxxp://overleaf.com
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hxxp://pachosting.hk

hxxp://panamaserver.com

hxxp://parsonline.com

hxxp://parspack.com

hxxp://pavietnam.vn

hxxp://pin.se

hxxp://pirateshosting.net

hxxp://planetahost.ru

hxxp://plus.hr

hxxp://pndc.ir

hxxp://portlane.com

hxxp://powerhost.cl

hxxp://privatelayer.com

hxxp://pro-managed.com

hxxp://proen.co

hxxp://proen.co.CARDING FORUM

hxxp://proen.co.th

hxxp://profivps.hu

hxxp://prq.se

hxxp://ps.kz

hxxp://ptclcloud.com.pk

hxxp://pttrs.net

hxxp://pw-service.com

hxxp://qsscloud.ba

hxxp://rackend.com

hxxp://racklodge.com

hxxp://racknation.cr

hxxp://radore.com

hxxp://rapidcompute.com

hxxp://rayadatacenter.com

hxxp://renter.ru

hxxp://rockhoster.com

hxxp://ru-tld.ruen

hxxp://rusonyx.ru

hxxp://rx-name.ua
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hxxp://sadecehosting.com

hxxp://securehost.com

hxxp://selectel.com

hxxp://semele.com.tr

hxxp://seohosting.com.tr

hxxp://server.ua

hxxp://serverastra.com

hxxp://serverhk.org

hxxp://serverhosting.my

hxxp://serveria.com

hxxp://servidores.gamerlive.cl

hxxp://shinjiru.com

hxxp://simplecloud.ru

hxxp://sinohosting.net

hxxp://smart-hosting.ro

hxxp://solarcom.ch

hxxp://sologigabit.com

hxxp://space.kz

hxxp://starrydns.net

hxxp://sunnyvision.com

hxxp://superhosting.net

hxxp://swedehost.net

hxxp://swedendedicated.com

hxxp://synwebhost.org

hxxp://syt.com

hxxp://t4.cr

hxxp://takewyn.com

hxxp://tchile.com

hxxp://tehnodom.com

hxxp://tele-asia.net

hxxp://teleklik.ba

hxxp://thnic.co

hxxp://thnic.co.CARDING FORUM

hxxp://thnic.co.th

hxxp://thost.ru
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hxxp://tilaa.com

hxxp://time4vps.eu

hxxp://timeweb.com

hxxp://tomtel.ru

hxxp://tophost.mden

hxxp://trabia.com

hxxp://trvps.net

hxxp://tucha.ua

hxxp://uanode.net

hxxp://uar.net

hxxp://udasha.com

hxxp://ukraine.com.ua

hxxp://ukrdc.net

hxxp://ukrnames.com

hxxp://ultratechhost.com

hxxp://underhost.com

hxxp://unit-is.com

hxxp://uniteddc.net.ua

hxxp://urdn.com.ua

hxxp://valuehost.ru

hxxp://vds64.com

hxxp://vdsinside.com

hxxp://vhoster.net

hxxp://victoriagroup.me

hxxp://vinahost.vn

hxxp://vinastar.net

hxxp://virtono.com

hxxp://virtualpark.hu

hxxp://vit.com.tr

hxxp://voxility.com

hxxp://vps.ag

hxxp://vpsbg.eu

hxxp://vpsgod.com

hxxp://vscale.io

hxxp://vstoike.ru
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hxxp://warez-host.com

hxxp://wavecom.ee

hxxp://web-server.eu

hxxp://webcare360.com

hxxp://webhost.tn

hxxp://webonic.hu

hxxp://webservices.dz

hxxp://webuzo.net

hxxp://weservit.nl

hxxp://wrzhost.com

hxxp://xenyohosting.com

hxxp://xeonbd.com

hxxp://xethost.com

hxxp://xhostfire.com

hxxp://xservers.ro

hxxp://yourserver.se

hxxp://zgh.cl

hxxp://zomro.com

Happy hunting.

1. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhlMlzU23GyZuuaYyR-5lKegn-MZuIe8fUJIdQs7pJelfAqS

98Osof6kvX0aBqHUL7V-zg0AeGBls9P6a5O_GLOSKUbVIKpO_j044O

1.6.5 Exposing

a

Currently

Active

Personally

Identifiable

Cybercriminals

XMPP/Jabber Account IDs Portfolio (2023-08-20 21:37)

[1]
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Folks,

I’ve been recently digging deep into the ever evolving cybercrime ecosystem doing research and trying to supply as much personally identifiable information on the bad guys in the form of personally identifiable email address accounts including XMPP/Jabber account IDs where the ultimate goal would be to properly assist everyone on their way to properly do their research including the U.S Intelligence Community and U.S Law Enforcement on its way to properly track down and monitor the individuals behind these campaigns.

In this post I’ll share with everyone a recently processed portfolio of personally identifiable XMPP/Jabber account IDs with the idea to assist everyone on their way to properly do their research including to assist the U.S Intelligence Community and U.S Law Enforcement on its way to properly track down and monitor these individuals.

Happy research.

Sample personally identifiable cybercriminals XMPP/Jabber account IDs include: fastchk@dlab.im

fastchk@dukgo.com

fastchk@xmpp.su

seotest@swissjabber.ch

coding@xmpp.jp

j _sparrow@business.cc

ksx@jabber.dk
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egeg@0nl1ne.at

support@1vpns.com

firstvpn@jabber.cz

synack@xjabber.org

jedecapua@fbi.gov

mvanderbunt@fbi.gov

Alexander.Gutwin@europol.europa.eu

Catarina.Nunes-Ladeira@europol.europa.eu

aalmarri@dubaipolice.gov.ae

k.alhosani@dubaipolice.gov.ae

dosx@exploit.im

cityofgod@exploit.im

synack@sj.ms

ia@exploit.im

topdos@verified.pm

moviestar@jabber.de

looklingtobuy@xmpp.jp

dr32@exploit.im

ari100krat@jabber.mipt.ru

markus123@jabber.cz

vetman3@blah.im

marquis@wiuwiu.de

b0rman@xmpp.jp

synack@dlab.im

synack2@dukgo.com

synack@xmpp.su

topdos@xmpp.jp

maestro@jabber.at

chopin@exploit.im

chop@none.su

web47@xabber.de

m4doff@sj.ms

asuwant@exploit.im

asuwant@jabber.ccc.de

dibua@thesecure.biz
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sales@vip-support.org

support@vip-support.org

starik@thesecure.biz

valek.dennikov@gmail.com

fizot@mail.ru

xtexcounter@bk.ru

wm.lancelot@gmail.com

maravanio@gmail.com

mserver@mail.ru

game@gameprom.com

ahmed _yurlanov1988@protonmail.com

kurganlab@mail.ru

koska@jabber.ccc.de

polobandit@xmpp.jp

supahelp@jaim.at

finedumps.com@exploit.im

trackz@mpro.la

trackz@pkey.in

dpp@exploit.im

d4s@jabber.fr

roxas@swissjabber.ch

planet9@sj.ms

g3mz@exploit.im

A.M.I.G.O.S@exploit.im

p-x@hacker.im

wermonter@neko.im

hitro@roteshield.ru

jasha@zauris.ru

onkelzzz@pandion.im

none _1@xmpp.jp

asuwant@mfclub.ws

prof777@xmpp.jp

no.like.other@jabber.cd

qir@codingteam.net

greystone@jabber.cn
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success@xmpp.pro

acsys@xmpp.jp

shopbuyshop@sj.ms

ps2k20@jabber.ru

swarmshop@verified.pm

bcd@europe.com

worldofproxy@inbox.ru

steryk@mail.ru

flycracker@jabba.in

serg@kaddafi.me

sandman@jab.im

keeloq@crypto.rub.de

platplus@tormail.net

bridges@torproject.org

phantominfo@xanon.net

soupnazi@efnet.ru

i.am@padonaque.info

Leroy2004@mail.ru

Kup _land@mail.ru

mater.gang@jabba.biz

pro.stuffer@exploit.im

exroot@exploit.im

night.walker@xmpp.jp

master.zu@mfclub.ws

master.zu@exploit.im

aventus@jabba.biz

aventus@xmpp.jp

epicman@thesecure.biz

fingerlink@exploit.im

well.good@thesecure.biz

pete777@mail.ru

cps@calgarypolice.ca

desertmack@mailvault.com

chinabig1@gmail.com

Gangass@exploit.im
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gangass@jabber.at

kjlj@adjdjjg.com

fidel _orders@yahoo.com

kk@prozvon.us

rdm-yandex@nnm.ru

p1gs@xmpp.jp

viking@0nl1ne.at

888300@exploit.im

vvMvv@exploit.im

kkk@jid.pl

bruj@jabber.minus273.org

support@1jabber.com

admin@1jabber.com

pferguson@cizmicconsulting.com

2002@chatme.im

negro _albino@jabber.ru

golden _triangle@xmpp.jp

masonhppy@gmail.com

universe@sj.ms

dds@xmpp.jp

d02@xmpp.jp

consilium@sj.ms

forename.lastname@cl.cam.ac.uk

ika@jabber.cx

elcondor@thesecure.biz

scans@v0id.cc

garry.wu@safe-mail.net

0121@sj.ms

stas _vl@mail.ru

s3x@neko.im

rubensamvelich@yahoo.com

boookscafe@yahoo.com

you@yourmail.com

Server2009@SMB3.local

Beny.Krick@jabber.in
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dsp559@hotmail.com

andres555@rambler.ru

vrublevsky@chronopay.com

p.vrublevsky@chronopay.com

red@mail-eye.com

myusername@mywebsite.com

mnsclec@gmail.com

mick@sensorynetworks.com

icq _uin@qip.ru

info@kaspersky.com

forum@kaspersky.com

webmaster@kaspersky.com

icamis@carderplanet.cc

contact@privacyprotect.org

tiny@webmoney.ru

admin@gmail.com

support@igatele.com.tw

kevinchu@igatele.com.tw

service@xinonet.cn

support@echonet.tw

noc@cexlink.cn

wang@xterra.tw

tsai@islnet.cn

noc@twinnet.tw

no.valid.email@worldnic.com

chan@twinnet.tw

lee.eric@echonet.tw

d0a9bd362531bfc787826bfe5fb75b47@todaynic.biz

j.yang@cexlink.cn

kim@xinonet.cn

plastics@webmoney.ru

val@carderplanet.cc

qip@carderplanet.cc

kk@carderplanet.cc

tt@carderplanet.cc
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fj10@carderplanet.cc

caesar@carderplanet.cc

powerseller@carderplanet.cc

rdmya@carderplanet.cc

dohlii@carderplanet.cc

complain@carderplanet.cc

afelio@carderplanet.cc

mike@carderplanet.cc

ultimatum@carderplanet.cc

ika@jabber.sg

pass@xxx.com

bre@headcounter.org

godtimees@jabber.org

parrotard@jabber.org

komproll@thesecure.biz

razin@carderplanet.cc

sccss@xmpp.pro

irzhik007@limun.org

v0id _cc@hotmail.com

v0id@jabber.cn

dongle0101@yahoo.com

nrew89@gmail.com

andrey89@nextmail.ru

nestle@neko.im

mazafaka@libero.it

777flyck777@gmail.com

gugusik@thesecure.biz

partyzan@thesecure.biz

cr4sh0@gmail.com

anti _xabar@mail.ru

p@safenrgy.com

box4qip@mail.ru

nolme@swissjabber.ch

barlog@0nl1ne.at

karabas@jabbim.com

1090

supportstyle@jabbim.com

hkn@novonordisk.com

sal@jabba.in

dominium@thesecure.biz

ika@jabba.in

ika@thesecure.biz

dearadmin@jabber.org

sal@jabber.sg

privatenet@jabber.cx

billpaid@xmpp.jp

marshm3llo@exploit.im

mak@mazafaka.info

brainjabber@default.rs

cart3r@shangryla.net

solid _s@carderplanet.cc

k3@pbank.com.ua

4docent@gmail.com

user@example.org

leeloodallas@jabber.org

brando@jabber.no

fly@darklife.ws

narcause@swissjabber.ch

best _bunnn@hotmail.com

robinbobin@jabber.cn

everything@jabber.ms

pipl-partners@jabber.xakep.kz

janus@haliluya.biz

rs-socks@thesecure.biz

kentyay@yahoo.com

hunterirby@yahoo.com

Shakil999@yahoo.com

dr _uploader1@mail.ru

dr _uploader@yahoo.com

cyberalibi@gmail.com

asadcp@mail.ru
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sd@fucksheep.org

x86 _64nsd@fucksheep.org

northpole@live.com

u@yahoo.co.uk

ika@spam.coop

slevin@europe.com

alexmussel@aol.com

novashogun18@live.com

satoshi@gmx.de

whitephoenix@mail.ru

alesiayglesias@yahoo.com

crazzzyhorse79@aol.com

icamis@4host.info

judidadada@btinternet.com

spdteam@tom.com

conf@infosystem.ru

syrian.es.sy@gmail.com

sea@sea.sy

sal@thesecure.biz

jrandom@example.com

m0udi@9.cn

Flouf@live.fr

support@webmoney.ru

1234@ftp.narod.ru

h0mini@mail.ru

mavook@gmail.com

troxel@yandex.ru

arxwolf2010@mail.ru

certificate@trustcenter.de

premium-server@thawte.com

psyche.evolution@gmail.com

Eagle@diginf.ru

ronnich@gmail.com

nenastnyj@gmail.com

volodyja@gmail.com
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vlaman@gmail.com

transitaircargoinc@gmail.com

bashorg@talking.cc

xtexgroup@gmail.com

Krotreal@mobsoft.com

andrew@elitum.com

redeye@jabber.no

andy@imjabber.com

asdas12334@mail.ru

andy@im.despmedia.com

shaman@gateline.net

dgc@gateline.net

WHanlinLittleton@gmail.com

cwilson2020@comcast.net

flynavy@hotmail.com

Mangerfredmanger@gmail.com

capellau1968.test@yahoo.it

pr@cray.com

tcouch@microsoft.com

ir@cray.com

fc@mail-eye.com

h07@interia.pl

service@youtube.com

silentbob@safe-mail.net

cuneiform@cognitive.ru

maestro@jabber.org

eims@ic.fbi.gov

onenote@exploit.im

maestro@jabbber.at

USADC.VIS.USvTMCCormick@usdoj.gov

reshenie _problem@yahoo.com

agressor@evilium.com

666@agressor.cc

juliethotel@hotmail.com

support@dropping-service.biz
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admin@NetworkSolutionsmsx.co.uk

sad@aol.com

asf@msn.com

gfhgf@yahoo.com

kk@sgarrist.net

myname@mymail.com

support@synebs.com

mih@colt.ilogic.ru

forum@pont.ru

agslab@gmail.com

cgi-mailer-bounces-90434292@kundenserver.de

E1CcQXv-0002Wz-00@mrvnet.kundenserver.de

abuse@kundenserver.de

clansman@pisem.net

chrischilds10@btinternet.com

kirsty314@hotmail.com

order@info-dumps.com

peacockpower@excite.com

flexip@mail.ru

burkan02@hotmail.com

admin@go.org.ua

kavkey@mail.ru

xxx@xxx.com

zadnica12@hotmail.com

zadnica12@aol.com

zadnica12@yahoo.com

Rabota1rubl@mail.ru

jag@jabba.biz

salinemotors@safe-mail.net

at@fsb-rf.ru

drondron@safe-mail.net

abase@hotmail.com

aesop@hotmail.com

ail@hotmail.com

ape@hotmail.com
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appear@hotmail.com

athens@hotmail.com

bare@hotmail.com

bays@hotmail.com

being@hotmail.com

belt@hotmail.com

bills@hotmail.com

blurs@hotmail.com

bosom@hotmail.com

chafe@hotmail.com

chimp@hotmail.com

closet@hotmail.com

cobble@hotmail.com

coda@hotmail.com

coup@hotmail.com

cram@hotmail.com

decor@hotmail.com

dee@hotmail.com

diets@hotmail.com

doily@hotmail.com

douse@hotmail.com

drank@hotmail.com

eagle@hotmail.com

edges@hotmail.com

extent@hotmail.com

feel@hotmail.com

fetal@hotmail.com

focus@hotmail.com

foxy@hotmail.com

fully@hotmail.com

gamut@hotmail.com

globe@hotmail.com

glum@hotmail.com

gmt@hotmail.com

guard@hotmail.com

1095

heath@hotmail.com

hints@hotmail.com

hired@hotmail.com

hydra@hotmail.com

ida@hotmail.com

incest@hotmail.com

inner@hotmail.com

john@hotmail.com

joshua@hotmail.com

lava@hotmail.com

lawn@hotmail.com

lax@hotmail.com

lids@hotmail.com

lime@hotmail.com

loll@hotmail.com

loved@hotmail.com

mary@hotmail.com

mats@hotmail.com

meal@hotmail.com

meek@hotmail.com

might@hotmail.com

mno@hotmail.com

momma@hotmail.com

mommy@hotmail.com

mope@hotmail.com

mum@hotmail.com

nba@hotmail.com

nil@hotmail.com

oral@hotmail.com

oust@hotmail.com

owe@hotmail.com

path@hotmail.com

paula@hotmail.com

pen@hotmail.com

plead@hotmail.com
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plump@hotmail.com

poll@hotmail.com

pupil@hotmail.com

rash@hotmail.com

rep@hotmail.com

review@hotmail.com

rims@hotmail.com

roads@hotmail.com

roost@hotmail.com

ruins@hotmail.com

salami@hotmail.com

scold@hotmail.com

sid@hotmail.com

sink@hotmail.com

smoky@hotmail.com

sobs@hotmail.com

solemn@hotmail.com

sons@hotmail.com

spurt@hotmail.com

stan@hotmail.com

stick@hotmail.com

subs@hotmail.com

tame@hotmail.com

tempt@hotmail.com

toll@hotmail.com

toss@hotmail.com

ttt@hotmail.com

tuna@hotmail.com

vista@hotmail.com

weave@hotmail.com

weigh@hotmail.com

wharf@hotmail.com

xrays@hotmail.com

bug@hotmail.com

offer@hotmail.com
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names@hotmail.com

fucker@hotmail.com

CardOperations@thebancorp.com

sarphrmanager@hotmail.com

johneastwooddom@yahoo.com

tt@jabber.bz

support _tt@jabber.bz

login@jabber.ru

ylrahwlu@bolander.com

novalogico@nycny.net

ro@jabber.ru

astr0@astr0.ru

tqpo21@gmail.com

ccmaster@mail.ru

roksalena@inbox.lv

drug@qwarta.ru

waldi@debian.org

ccrc@crime-research.org

vbrjw@hotmail.com

vbzn@hotmail.com

vcfa@hotmail.com

vcfzrym@mail.com

vcgq@hotmail.com

vcqwprb@hotmail.com

vcrz@hotmail.com

vczjdt@hotmail.com

vdbxwpy@hotmail.com

vdguo@hotmail.com

k55v7ubfct@o0v4o.net

k56to3y71u@v1efd.com

k5nx3gygla@szkw3.com

k67bly43zd@li07y.org

k68v3yp7pl@3qnqo.net

k6i7j77bln@vt5gm.org

k6ic5gpcxh@dnd72.org
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sonya@kp.ua

jim@anchorcontrols.com

chutchins1@cfl.rr.com

arbitrage@webmoney.ru

lir-admin@rdsnet.ro

hostmaster@ripe.net

xxx@mail.com

xxxxxxx@alltown.com

xxxxx@pacbell.net

buster@mail.natm.ru

123@mail.com

vernon _walcott@yahoo.com

dcreech2005@hotmail.com

dcreech1999@yahoo.com

mailname@domain.com

henor@jabber.bz

henor@jabber.org

passport@wmtransfer.com

client@jabber.vendorsname.vn

petr@digitalspy.ru

hoocker82@mail.ru

xxx@yandex.ru

later@jabber.vendorsname.vn

anti-laksys@mail.ru

Ahi@ajabber.net

sales@rpr1insider.de

fanesso@jabber.bz

kim405@bellsouth.net

support@microsoft.com

vn@conference.jabber.bz

client@jabber.bz

zig-service@thesecure.biz

dots@thesecure.biz

saturn@jabber.bz

MAILER-DAEMON@yahoo.com
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later@ajabber.net

translater@thesecure.biz

later@jabber.bz

srv@xxx.com

teamproject@mjabber.info

teamproject@jabber.bz

flycracker@jabber.bz

cashing@jabber.cn

s@shady.nl

donni _Brasco@jabba.in

Laurie.jensen@hotmail.com

Larry-Sarff1967@hotmail.com

DarianHall _Jr@hotmail.com

suspension@ebay.com

bio4life@aol.com

andrey2003@ngs.ru

grig _@fromru.com

affiliate@phreaker.net

shereen333@yahoo.com

support@balthost.ee

caliente@chat.ru

wmbox@mail.ru

falcones@tochka.ru

admin@fakeidscan.info

scan@ftp.fakeidscan.info

info@emailpromo.org

avensys@avensys.ru

encorew0rk@yahoo.com

richard.cole@rocketmail.com

junior.minor@yahoo.com

support@icamis.biz

joker@azz.ru

jrh@mail.ru

jnene@aol.com

abrown@ebay.com
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abuse@ebay.com

accessories@ebay.com

accettare@ebay.com

accidentally@ebay.com

account@ebay.com

acker@ebay.com

activity@ebay.com

actually@ebay.com

acy@ebay.com

acyaay@ebay.com

acyay@ebay.com

adevanss@ebay.com

admiller@ebay.com

admissions@ebay.com

adrian@ebay.com

ads@ebay.com

adults@ebay.com

advancer@ebay.com

adventures@ebay.com

advertising@ebay.com

advisers@ebay.com

aegean@ebay.com

affilates@ebay.com

affiliates@ebay.com

afiliados@ebay.com

afraid@ebay.com

agendum@ebay.com

agility@ebay.com

agree-questions@ebay.com

agree@ebay.com

aide@ebay.com

aly@ebay.com

andrew@ebay.com

anita@ebay.com

antiquemall@ebay.com
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antiques@ebay.com

april@ebay.com

arity@ebay.com

arlene@ebay.com

arly@ebay.com

armand@ebay.com

arnold3a@ebay.com

arnold@ebay.com

art@ebay.com

assistant@ebay.com

assistenza@ebay.com

assurance@ebay.com

astein@ebay.com

atch@ebay.com

ation@ebay.com

auaffiliates@ebay.com

auagreequestion@ebay.com

auprivacy@ebay.com

ausafeharbour@ebay.com

ausuggest@ebay.com

ausupport@ebay.com

aw-confirm@ebay.com

aw@ebay.com

awagoner@ebay.com

beanbags@ebay.com

beck@ebay.com

billing@ebay.com

booksmag@ebay.com

brian@ebay.com

bscheuer@ebay.com

bscholle@ebay.com

bsmith@ebay.com

buddy@ebay.com

buddyitems@ebay.com

business@ebay.com
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bworkman@ebay.com

caagreequestion@ebay.com

canard@ebay.com

cars@ebay.com

cassi@ebay.com

casuggest@ebay.com

casupport@ebay.com

cbrown@ebay.com

cericson@ebay.com

cfroysla@ebay.com

cgould@ebay.com

charity@ebay.com

chayes@ebay.com

checkitout@ebay.com

chinatown@ebay.com

coderisme@ebay.com

coins@ebay.com

collctbl@ebay.com

colleen@ebay.com

comics@ebay.com

computer@ebay.com

confidentiel@ebay.com

counters@ebay.com

cthornhi@ebay.com

ctywatch@ebay.com

damnproxies@ebay.com

daphne@ebay.com

david.smith@ebay.com

ddonovan@ebay.com

ddonovie@ebay.com

decline@ebay.com

dee@ebay.com

derevia@ebay.com

diffamation@ebay.com

dj@budsonthebay.com

1103

dkourian@ebay.com

dlevy@ebay.com

dolls@ebay.com

dpride@ebay.com

drew@ebay.com

dusty@ebay.com

eabram@ebay.com

ebay@ebay.com

ebayseller@ebay.com

ebayuniversity@ebay.com

ebentley@ebay.com

eguiller@ebay.com

electronics@ebay.com

elvis@ebay.com

emerge@ebay.com

ewatch@ebay.com

fashion@ebay.com

forrest-eastbound@ebay.com

foundation@ebay.com

fraud@ebay.com

fryen@ebay.com

gallery@ebay.com

gcqueue@support.gc.ebay.com

gianni@ebay.com

goglobal@ebay.com

golocal@ebay.com

good2deal _with@ebay.com

gr8 _2dealwith@ebay.com

gzemor@ebay.com

haley@ebay.com

hobbies@ebay.com

holly@ebay.com

infringement@ebay.com

investigazione@ebay.com

investor _relations@ebay.com
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iprequest@ebay.com

istrack@ebay.com

itagreequestion@ebay.com

jackie@ebay.com

jaoe@ebay.com

jchu@ebay.com

jerry@ebay.com

jesse@ebay.com

jewelry@ebay.com

jhancock@ebay.com

jhoward@ebay.com

jhuff@ebay.com

jkim@ebay.com

jmathiso@ebay.com

jmmartin@ebay.com

jmoe6869@ebay.com

joan@ebay.com

jobs@ebay.com

jparaske@ebay.com

jperrine@ebay.com

jwalter@ebay.com

kane@ebay.com

katia@ebay.com

katy@ebay.com

kawiley@ebay.com

kaye@ebay.com

kazim@ebay.com

kbauer@ebay.com

kcity@ebay.com

keith@ebay.com

kelley@ebay.com

kelly@ebay.com

ken@ebay.com

kerseem@ebay.com

kevinp@ebay.com
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kgyij6rls9a@ebay.com

kharper@ebay.com

kim@ebay.com

kim _stone@ebay.com

kindhearted@ebay.com

kking@ebay.com

klubavs@ebay.com

lagcsupport@ebay.com

lbabcock@ebay.com

lchamber@ebay.com

leo@ebay.com

lisa@ebay.com

lmarcus@ebay.com

localtrading@ebay.com

louise@ebay.com

lwood@messagebay.com

maeve@ebay.com

management@ebay.com

marketing@welcome.ebay.com

matrim@ebay.com

mbingham@ebay.com

misterlister@ebay.com

mkadic@ebay.com

moana@ebay.com

moreinfo@ebay.com

motors-suggest@ebay.com

motors-support@ebay.com

mr.mintcamera@ebay.com

mschauga@ebay.com

muebelha@ebay.com

music@ebay.com

mye@comparebay.com

newebay@ebay.com

ngilbert@ebay.com

nicola.coxson@ebay.com

1106

nlofgren@ebay.com

onlineideas@ebay.com

patti@ebay.com

pbtagsale@ebay.com

pclarke@ebay.com

perfectpay@ebay.com

photo@ebay.com

pickle@ebay.com

pkeller@ebay.com

pongo@ebay.com

pottery@ebay.com

powerit@ebay.com

powersellersinfo@ebay.com

premiersupport@ebay.com

privacy@ebay.com

pwatz@ebay.com

pwitten@ebay.com

questionconditions@ebay.com

queue@support.ebay.com

randyj@mobilebay.com

recommended _4 _u@ebay.com

renee@willges.ebay.com

report@ebay.com

rich-westbound@ebay.com

rminenno@ebay.com

rpruitt@ebay.com

rs@ebay.com

rstanger@ebay.com

rswebform@ebay.com

rt@ebay.com

rthomas@ebay.com

rthompso@ebay.com

rules@ebay.com

rumbi.pfende@ebay.com

russ@ebay.com
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ry01tnwizaj@ebay.com

sa@ebay.com

saaeo@ebay.com

safe@ebay.com

safeguard@ebay.com

safehabor@ebay.com

safeharbor@ebay.com

safeharbour@ebay.com

safehorbor@ebay.com

safetradingenhancements@ebay.com

safety@ebay.com

safetyharbor@ebay.com

saftharbor@ebay.com

saj2er@ebay.com

sales@ebay.com

sandres@ebay.com

sara@ebay.com

scifi@ebay.com

seniors@ebay.com

service@ebay.com

sgrov2@ebay.com

sgrov3@ebay.com

shari@ebay.com

shiggins@ebay.com

shillers@ebay.com

sienna@ebay.com

sonny@ebay.com

sports@ebay.com

st@ebay.com

stamps@ebay.com

suggest@ebay.com

support@ebay.com

susan@ebay.com

sutley@ebay.com

swalker@ebay.com
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sydney@ebay.com

tasfuchs@ebay.com

tborovat@ebay.com

tes@ebay.com

thr0210@aol2.ebay.com

timepieces@ebay.com

timesensitive@ebay.com

tmckenna@ebay.com

tmichaels@ebay.com

toysbbs@ebay.com

tutor@ebay.com

ukinvestigations@ebay.com

ukprivacy@ebay.com

uksupport@ebay.com

user@ebay.com

vinnie@ebay.com

wking@ebay.com

peter@severamail.com

postmaster@deadhouse.ru

nastoyashiy@user.com

spoof@ebay.com

ok@msk.zoo.ru

urina-ru@yandex.ru

this.Dswartz@bju.edu

intim _hard _sex _porno2006@mail.ru

admin@LawServices.ru

admin@x25.cc

kenny@mighty.co.za

jack2001@o2.pl

bobjackson@zwallet.com

blablabla@comcast.net

service@paypal.com

tracking@yandex.ru

jobs@google.com

ddu@e-gold.com

1109

euro-imperial@mail.com

zlodei@prvmail.net

errrtt@gmail.com

prozvon-us@safe-mail.net

issuer1@10910599114111115111102116.com

issuer2@10910599114111115111102116.com

support@krutikservers.com

peter@severa.biz

interest@netbilling.com

xxxxx@mail.ru

wrznet@yahoo.com

eh _raider04@yahoo.com

sjooneor@yahoo.com

ddmann226@hotmail.com

mattman436@netscape.net

cadhudson@prodigy.net

denis@bizcom.dol.ru

bizcom@cityline.ru

azurevn@bk.ru

cool-sam@yandex.ru

easy@easycash.ru

alexey@migtel.ru

renzo@bk.ru

easycash@mail.ru

QEAAAAA@migtel.ru

easy _cash@ru.ru

web-17467459@zbackend1.aha.ru

Rachel.Chan@rackspace.co.uk

admin@inet-reklama.ru

dbmaster@jopasoft.com

opa@yandex.ru

fsb@fsb.ru

mlu@jabber.ru

prokaznik@metronome.ru

eburg@mail.portland.co.uk

1110

s@gmail.com

ck@neomailbox.com

info@cyb-security.net

asdqwdasd@asdasdaq.com

gc _ww@hotmail.com

websupport@kspu.karelia.ru

bucklerw@hotmail.com

fialex@usa.com

Kristen.Gaither@careerbuilder.com

all-about-all@mail.ru

mortonzmail@jabber.org

blabla@e-gold.com

skynetlaboratory@yahoo.com

fraud@fraud.name

affquestion@gmail.com

holder@holder.com

info@abdullahost.com

247support@live.ru

support@tiket.cc

signmark@gmail.com

xxxxxxxx@mail.ru

develop@ancud.ru

justinsholl@yahoo.com

signmark@bespont.com

7eLO2428 _ddu@e-gold.com

hujomajo@gmail.com

bp@jabber.vendorsname.vn

noar@jabber.bz

ruppert@jabber.bz

Phantom@jabber.bz

mendozas@jabber.bz

asa@jabber.bz

donni _brasco@jabber.bz

X-RAY@jabber.bz

donni _brasco@jabber.dz
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bp@jabber.bz

dyadya@ajabber.net

fff3fff@jabber.bz

salomon@jabber.bz

eskalibur@eskaliburinform.com

help-bison@gnu.org

suport@superbank.com

Sample

personally

identifiable

cybercriminals

XMPP/Jabber

account

IDs

sorted

by

XMPP/Jabber provider include:

seotest@swissjabber.ch

ksx@jabber.dk

firstvpn@jabber.cz

synack@xjabber.org

moviestar@jabber.de

ari100krat@jabber.mipt.ru

markus123@jabber.cz

maestro@jabber.at

asuwant@jabber.ccc.de

koska@jabber.ccc.de

d4s@jabber.fr

roxas@swissjabber.ch

no.like.other@jabber.cd

greystone@jabber.cn

ps2k20@jabber.ru

gangass@jabber.at

bruj@jabber.minus273.org

support@1jabber.com

admin@1jabber.com

negro _albino@jabber.ru

ika@jabber.cx

Beny.Krick@jabber.in

ika@jabber.sg

godtimees@jabber.org

parrotard@jabber.org

v0id@jabber.cn

nolme@swissjabber.ch
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dearadmin@jabber.org

sal@jabber.sg

privatenet@jabber.cx

brainjabber@default.rs

leeloodallas@jabber.org

brando@jabber.no

narcause@swissjabber.ch

robinbobin@jabber.cn

everything@jabber.ms

pipl-partners@jabber.xakep.kz

redeye@jabber.no

andy@imjabber.com

maestro@jabber.org

tt@jabber.bz

support _tt@jabber.bz

login@jabber.ru

ro@jabber.ru

henor@jabber.bz

henor@jabber.org

client@jabber.vendorsname.vn

later@jabber.vendorsname.vn

Ahi@ajabber.net

fanesso@jabber.bz

vn@conference.jabber.bz

client@jabber.bz

saturn@jabber.bz

later@ajabber.net

later@jabber.bz

teamproject@mjabber.info

teamproject@jabber.bz

flycracker@jabber.bz

cashing@jabber.cn

mlu@jabber.ru

mortonzmail@jabber.org

bp@jabber.vendorsname.vn
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noar@jabber.bz

ruppert@jabber.bz

Phantom@jabber.bz

mendozas@jabber.bz

asa@jabber.bz

donni _brasco@jabber.bz

X-RAY@jabber.bz

donni _brasco@jabber.dz

bp@jabber.bz

dyadya@ajabber.net

fff3fff@jabber.bz

salomon@jabber.bz

fastchk@xmpp.su

coding@xmpp.jp

looklingtobuy@xmpp.jp

b0rman@xmpp.jp

synack@xmpp.su

topdos@xmpp.jp

polobandit@xmpp.jp

none _1@xmpp.jp

prof777@xmpp.jp

success@xmpp.pro

acsys@xmpp.jp

night.walker@xmpp.jp

aventus@xmpp.jp

p1gs@xmpp.jp

golden _triangle@xmpp.jp

dds@xmpp.jp

d02@xmpp.jp

sccss@xmpp.pro

billpaid@xmpp.jp

dosx@exploit.im

cityofgod@exploit.im

ia@exploit.im

dr32@exploit.im
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chopin@exploit.im

asuwant@exploit.im

finedumps.com@exploit.im

dpp@exploit.im

g3mz@exploit.im

A.M.I.G.O.S@exploit.im

pro.stuffer@exploit.im

exroot@exploit.im

master.zu@exploit.im

fingerlink@exploit.im

Gangass@exploit.im

888300@exploit.im

vvMvv@exploit.im

marshm3llo@exploit.im

onenote@exploit.im

fastchk@dlab.im

dosx@exploit.im

cityofgod@exploit.im

ia@exploit.im

dr32@exploit.im

vetman3@blah.im

synack@dlab.im

chopin@exploit.im

asuwant@exploit.im

finedumps.com@exploit.im

dpp@exploit.im

g3mz@exploit.im

A.M.I.G.O.S@exploit.im

p-x@hacker.im

wermonter@neko.im

onkelzzz@pandion.im

sandman@jab.im

pro.stuffer@exploit.im

exroot@exploit.im

master.zu@exploit.im
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fingerlink@exploit.im

Gangass@exploit.im

888300@exploit.im

vvMvv@exploit.im

2002@chatme.im

s3x@neko.im

nestle@neko.im

marshm3llo@exploit.im

onenote@exploit.im

dibua@thesecure.biz

starik@thesecure.biz

epicman@thesecure.biz

well.good@thesecure.biz

elcondor@thesecure.biz

komproll@thesecure.biz

gugusik@thesecure.biz

partyzan@thesecure.biz

dominium@thesecure.biz

ika@thesecure.biz

rs-socks@thesecure.biz

sal@thesecure.biz

zig-service@thesecure.biz

dots@thesecure.biz

translater@thesecure.biz

Stay tuned!

1. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh6bohGpm7FEyAUI2XxSEWUIdGXEt4iWf2z7TOKp4sskARmU

gD1M2hy_YpiaPu5bSDAADPI2aKzAYbc9eqSa4mBuJCMp_odEK4V1RY

1.6.6 A Compilation of Personally Identifiable Email Address Accounts Known to Belong to Ransomware Operators (2023-08-20 21:37)

[1]
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Dear blog readers,

The following is a set of personally identifiable email address accounts known to belong to ransomware operators or participants in ransomware-themed affiliate-based partner programs which I’ve decided to share with everyone doing research on the topic and looking for clues or additional resources on how to improve their research including U.S Law Enforcement where the ultimate goal would be to track down monitor and prosecute the individuals behind these campaigns internationally.

Sample personally identifiable email address accounts known to belong to ransomware operators or members of ransomware themed affiliate-based networks include: restorealldata@firemail.cc

gorentos@bitmessage.ch

doctor777@mail.fr

b _@mail2tor.com

databack44@tuta.io

mosteros@firemail.cc

nmosteros@firemail.cc

ngorentos@bitmessage.ch

godecrypt@onionmail.org

kryzikrut@airmail.cc

lockhelp@qq.com

hlper4y@tutanota.com

milleni5000@qq.com

rdpconnect@protonmail.com
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nullcipher@cock.li

greenlite@keemail.me

datos@onionmail.org

ks20296@email.vccs.edu

getdataback22@protonmail.com

zdarovachel@gmx.at

nzdarovachel@gmx.at

hupstore@keemail.me

Cobra _Locker@protonmail.com

nCobra _Locker@protonmail.com

yasomoto@tutanota.com

datos@msgsafe.io

ndatos@onionmail.org

emiliantor@mailfence.com

emilianazizi@tutanota.com

Jeremyspineberg11@tutanota.com

GeromeSkinggagard1999@tutanota.com

Jeremyspineberg11@protonmail.com

nJeremyspineberg11@tutanota.com

nGeromeSkinggagard1999@tutanota.com

nJeremyspineberg11@protonmail.com

caspers@scryptmail.com

caspers@tuta.io

helpteam38@protonmail.com

hccapx@protonmail.com

newpatek@cock.li

barboza40@yahoo.com

0x69x@protonmail.com

n0x69x@protonmail.com

trfgklmbvzx@aol.com

don.diablo@aol.com

varasto@firemail.cc

nvarasto@firemail.cc

umbrella _cor@zohomail.eu

numbrella _cor@zohomail.eu
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bebenrowan@aol.com

gonald58@cock.li

recoverydata52@protonmail.com

delta@onionmail.org

GruzinRussian@aol.com

Decipher@keemail.me

Salesrestoresoftware@firemail.cc

Mailrepa.lotos@aol.com

Space _rangers@aol.com

Salesrestoresoftware@gmail.com

amagnus@india.com

Decryptallfiles@india.com

Tessa88@exploit.im

answer@pcworld.com

Wisperado@india.com

Decryptallfiles3@india.com

Orgasm@india.com

Ncrypt@cock.li

Love.server@mail.ru

Bitcoinrush@imail.com

Batman _good@aol.com

Ninja _gaiver@aol.com

Help _you@india.com

Radxlove7@india.com

slaker@india.com

Suppteam03@india.com

safeanonym14@sigaint.org

Matrix9643@yahoo.com

Restore@protonmail.ch

Hairullah@inbox.lv

Calipso.god@aol.com

avastvirusinfo@yandex.com

Lavandos@dr.com

Mich78@usa.com

Mk _cyrox@aol.com
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Makedonskiy@gmx.com

fantomd12@yandex.ru

Melme@india.com

ihurricane@sigaint.org

Diablo _diablo2@aol.com

Makdonalds@india.com

VladimirScherbinin1991@gmail.com

mkgoro@india.com

Okean-1955@india.com

rescuers@india.com

Masterlock@india.com

garryweber@protonmail.ch

Milarepa.lotos@aol.com

Cocoslim98@gmail.com

Last _centurion@aol.com

samanta@scryptmail.com

Savepanda@india.com

Bnd54@mail2tor.com

Happydayz@india.com

Meldonii@india.com

Catsexy@protonmail.com

Sitaram108@india.com

bonum _malum@aol.com.onion

anony.killers@protonmail.com

Deccripted@gmail.com

Payfornature@india.com

Drugvokrug727@india.com

Helpme@freespeechmail.org

Ceri133@india.com

Agella@scryptmail.com

Age _empires@india.com

unlckr@protonmail.com

Supportfriend@india.com

Santa _helper@protonmail.com

A _Princ@aol.com
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Nomoneynohoney@india.com

Sos@anointernet.com

Fud@india.com

Suppteam01@india.com

Bitcoinpay@india.com

hnumkhotep@india.com

webmafia@asia.com

haizenberg@aol.com

Supermagnet@india.com

Systemdown@india.com

Raa-consult1@keemail.me

Opencode@india.com

Apple.pass@mail.com

black.world@tuta.io

DIGITALKEY@163.com

Thedon78@mail.com

Applehelp@caramail.com

Gerkaman@aol.com

Siddhiup2@india.com

Shark01@msgden.com

Help@decryptservice.info

Doctor@freelinuxmail.org

wyna@nyu.edu

Cyber _baba2@aol.com

Xbotcode@gmail.com

assistant@bitmessage.ch

Grapn206@india.com

Guardware@india.com

Decryptutility@protonmail.com

fixfiles@protonmail.ch

Ramachandra7@india.com

File-help@india.com

Recuperadados@protonmail.com

helpmeonce@mail.ru

Payransom@qq.com
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GuardBTC@cock.li

jonskuper578@india.com

Decrypthelp@qq.com

MildredRLewis@teleworm.us

Alex.vlasov@aol.com

Grand _car@aol.com

systems@tutanota.com

Seven _legion@aol.com

waiting@bitmessage.ch

szem@tutanota.com

Legioner _seven@aol.com

Peekabooo@qq.com

help _911 _support@rambler.ru

help@tutanota.com

Szems@tutanota.com

Tizer78224@india.com

Tizer77234@protonmail.com

recfiles@protonmail.com

Patagonoa92@tutanota.com

Worldcry@cock.li

Support _wc@bitmessage.ch

berr@keemail.me

Hellstaff@india.com

mr.dec@tutanota.com

mr.dec@protonmail.com

regem _regum@aol.com.onion

gardengarden@cock.li

JoniCarter@protonmail.com

servicedeskpay@protonmail.com

123@tutanota.com

crab7765@gmx.de

brbrcodes@gmail.com

datastore2018@mail.ru

f1220@tuta.io

sebastiennolet92@gmail.com
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bkp@cock.li

email-iizomer@aol.com

petropasevich@aol.com

blacklist@clock.li

Blacklist@cock.li

Mammon-decrypt@protonmail.com

Light _Yagami@tuta.io

backtonormal@foxmail.com

nikolateslaproton@protonmail.com

decoder-help@protonmail.com

kurosaki _ichigo@tutanota.com

decryptgarranty@airmail.cc

Pumarestore@india.com

lolitahelp@cock.li

wewillhelp@airmail.cc

wayneevenson@protonmail.com

Cyberwars@qq.com

yoursalvations@protonmail.ch

Grizzly@airmail.cc

incongnitoman@protonmail.com

InkognitoMan@tutamail.com

x _mister@aol.com

Funnybtc@airmail.cc

QyavauZehyco1994@o2.pl

Bestdecoding@cock.li

Usacode@aol.com

BTCBREWERY@protonmail.com

Decisivekey@tutanota.com

traher@dr.com

Pdfhelp@india.com

jundmd@cock.li

windat@protonmail.com

Supportdecrypt@firemail.cc

seed@firemail.cc

NastasyaTurkina68@mail.ru
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Merosa@india.com

Mrpeterson@cock.li

unlockdata@foxmail.com

ht2707@email.vccs.edu

callmegoat@protonmail.com

Bitcharity@protonmail.com.com

Vengisto@india.com

F-data@protonmail.com

audrey.b@aol.com

Vengisto@india.co

decryptxxx@protonmail.com

Gerentoshelp@firemail.cc

Mespinoza980@protonmail.com

daves.smith@aol.com

noreply@blogger.com

Badfail@qq.com

Cryptmanager@protonmail.com

decryptxxx@protonmail.co

daves.smith@aol.co

Cryfixfoo@qq.com

Merd@tutanota.com

mirey@tutanota.com

bitkick@protonmail.com

crypto.support@aol.com

keyforyou@tuta.io

room1ahC@secmail.pro.cr

3542516480@qq.com

flower.harris@protonmail.com

Recoverfile@protonmail.com

helpersmasters@airmail.cc

xzet@tutanota.com

Cho.dambler@yandex.com

Starbax@tutanota.com

che808@protonmail.com

Stay tuned!

1. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgJLjFOtgXO9AVXGPKwKzgO32Mo0xqf347EkrNGtc8BCP8iX

3VPrbWGNGmg2kDI71hRoer5qqAQ_oAsBDvMzSftyq0SGI2ao_2b3G6
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1.6.7 A New Anarchy RAT (Remote Access Tool) Malicious Software Spotted in the Wild (2023-08-20 21:37)

[1]

An image is worth a thousand words - part two.

I’ve recently came across to a newly released malicious software which basically allows novice and experienced users with the ability to launch and manage access to compromised corporate and home networks and PCs where the ultimate goal would be to do this as easy as possible.

Sample screenshots include:

[2]
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[3]

[4]
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[5]

Stay tuned!

1. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEianU5OezFUVBlMsRmJgNlvXDxj4S5yt_R2Pzy8M9eUuCbEl

N9-9_ioAq1kTSoJ8EG2H5HklHu0BEKKH9FMRPhXhs12v_FEefJxjiL

2. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg2XV_N9vUaLKI1Nm-BBM2eiFuywimK-Ysp5UaY_ZzdYycRw

JJCbp81jkhKMuXaEsJxgiuG1QnZe86m_NKuzjU1kCVgbVx0lMsOmfA

3. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi3uRy10QB8F5OLg4DVQc0XbyIUoRkJ_sBqPXyAB2krA_XGQ

4Cdfj0yk588N522jOaA0ZHdvDIjS4vpljUe3hJMFQlpRADzDXZrtsa

4. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj8B_smGB3O7UxQg1juCP1QxpaF6FOLN8cynOau1WQCQOrc5
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fayUZqeFHHM1V-RL7KOw8PADzBShp_sQlH_0JwaldfGjf-eKURGExd

5. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEitJ6EGOqt40MVK0wkokHkDEsV5CoMy_OYQllsW_mj6QvaIH

8MFyOFw8aDBx_e_ETXalDLekC6EWZPbjUNcGPsVARgz1tViKdn5L1f

1.6.8 A

DIY

Cryptocurrency

Exchange

Phishing

Kit

Spotted

in

the

Wild

(2023-08-20 21:37)

[1]

An image is worth a thousand words.

I’ve recently came across to a DIY cryptocurrency exchange phishing kit where basically the vendor allows you to set up your own fake cryptocurrency exchange which could be later on used to trick and entice users into falling victim into this scam potentially affecting hundreds of thousands of gullible users thanks to the professional DIY templates managed and operated by the vendor.

Sample screenshots include:

[2]
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[3]

[4]
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[5]

[6]
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[7]

[8]
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[9]

[10]
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[11]

[12]
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[13]

[14]
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[15]

[16]
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[17]

[18]
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[19]
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[20]

Stay tuned!

1. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh-ln4NAoMJ1dEt4DKXAZwESweVzcYbPQ7x5PM4JYVKAHcF9

ZHt_J1WYY_61kDrVAtzDqdjYChXG8Cgp2raRBt3OuFB83LdXPhfk1G

2. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjWwl8vYiWhQNgHVWdJV6XuvdKFfmrg-arWDJdtOzejtB-Sq

_nyhUTwS8Xo_4-3YsA0lzU7dADYruDOYkef3rgWZrrGzkVMhxv4kNe

3. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgVKImzAmw2OBrMoyVEZ5pEvglVDtQOgsn9netrW5mXYpUQ2

lqNrrXyF4JJ5qu061yjci8goOVfU2xzp61v8Lu6mSw8b7QJubD2yKT

4. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhSQhfa8OIIQPSZ_amaPY1LeY14bc79XsrZ3DVvwx2JZVLWp

9cPg_-8TNce77Tzb9jiV8d-TRB_HDTvDRMaRYgBDWdK-cn1cGRhQBr

5. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhSVwoQccI2YZFauJ0zhKWO0s0ag94WJFpBIh7QQzVMTlauB

zQSBIs_mUY2Obys0jf0YHlURo3_Fyo5T3JibLod7BBpF6j4BdhBSe1

6. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgUVA-1MvjvcSOly4SFnRbAVgnt4smtfvdKcH37OsyRxLZqq

g_s-SyylR5irWm7UATeBRz8LBWVK90ZX0g6XjZPQ4STvbihftJ08ak

7. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj-auIHgYruPDMEwlxWYeb-6xhA1zNva4LbvyABDKXDrU62L

ARfJVFbMvCwLoTuCScqsUMfBlp2NPc9KJgPN5bHYnjIYN2VU8r91EE

8. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj2PsQeBu_xCOg6jabzFLfKfjJHcprlYGZ1624P0WB9pZNoX

EdnIvGZaDtuOwyJpJH0HQcKfjw-0Uch2QUTUFBIgOGacE8q8fe5CMz

9. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgbXJAbZchrenTMT4oRsmvzGeO22XdnFLCGs5hKOsM_d-z1T

kdTDM0BqpP0mVPA3uWij7rEHhanddX0L4h9k6_I0asYfBPgRy9p8cV
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10.

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiH6_KQbJ5FGNTn-Bblt7Iq3UmFvdNANn9O9RzxdtY3AZA

H1ZwP1ivBDZ4k5Ns3DlVYj4clSE4xxscklsxc10QecWfW74k6euKJ9Wd

11.

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhrP2ZZIT51mfDDlwjF-L2iHlVl8dLnVcDp88VAZrJXUaZ

5prSP30wv0OLzXTxqWNtFccGe9YytHw3ammXK4d4naL7AqMFtg-eIT6e

12.

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjjNeV6ld5uXaDu5jd5rS2SAl7Sd-mLL1RhhTZaCNECvXv

9V0jyWMI9fsCZrXJxvrHVbvp4CHghoP0C10oEYB62uyOapsnm0VkFXT2

13.

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgCRcn9qi4fhTSZc2GuadWNOKBmLzwutquZhGTdB32cBKw

3YS8A8nHF51dpFpeFACp4irWAr0johPtzvIiH6LGaElcbPbke3HwQk89

14.

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi1lML5PbOw7NeFpJ85TntTeho28LGxtzwRiy3U2iToHA7

fFVQt80myVO7k8SPGmMcCyGZP2ROQq8k9MP3-9EgG86d9uHBiU8V_FOM

15.

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgOW6zgO1G2DRwQFMJJsVMXa9wpNwgSwEshjq36B7TxYwo

84ZgUPHB95y2mwvTgYuo6wJUoWJkKquDkPVzEH4kJ0XV6ltchaGKwo8m

16.

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgU9Qh9ot9q8SVAgoagzmnrGDNmdWkzeZcd-kVAPlc7Ang

Dc_AQ_WDbPpGZDSmR9e4nsjMYTO1Aht7jqPj210pKks1mh5GfRprOW67

17.

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiEFkelmvNSNEKqtE05fvz21Uybv97PbgN8LMZQipBNoMe

Tne2eoOFKc8xvTq0Ub7DE_ticajOs_sBJ8nGVOZ1BzAHu80dglj9_JWS

18. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiJOBzY9zus5Vi_KJUdqZYkrtXgA-Di6acHxn7mQ3US-RQ

Nwb-J6vY8DVxESS3uKpUUfRSDOBdWcrAIE7iS45WPUFcIJdJe7uQHstA

19.

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjQXIawSCZl5IiQWslgS7dQJIG6lh5JJ59_F5xBhssInQz

sddiqbp6ya_pIqGj5R3QgoZxOGd3wTCgflveAbQKxVU2VCqM-DMFcVWF

20. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhqhs7rnhYNEFFXB58DMIHA1T05BUxa1e_VXQZyx2MU-ua

zirmkyVZf0YXfaBjGjcpKEjBeoFaEv0LbljhOopskXiNdAfcILdzgxiB

1.6.9 Exposing

a

Currently

Active

Personally

Identifiable

Cybercriminals

XMPP/Jabber Account IDs Portfolio - Part Two (2023-08-20 21:38)

[1]
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This is the second part of recently obtained personally identifiable XMPP/Jabber account IDs known to belong to known and confirmed cybercriminals.

Happy research.

Sample personally identifiable cybercriminals XMPP/Jabber account IDs include: 1008200@jabber.ru

9@jabber.ru

android1@jabber.se

dumpscc@jabber.ru

jabber@jabber.com

lawton _supp _en@public-jabber.me

lawton _supp _ru@public-jabber.me

nik7kin@jabber.ru

nlawton _supp _en@public-jabber.me

nlawton _supp _ru@public-jabber.me

vicenzo@jabber.cz

bestdump@xmpp.jp

biceps@xmpp.jp

blackmambba@xmpp.jp
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bosherz@xmpp.jp

cc-street@xmpp.jp

flavour44@xmpp.jp

m-ickey@xmpp.jp

ssn24@xmpp.jp

Cardmafia@exploit.im

Ego@creep.im

cardvilla@exploit.im

chesterchitos@exploit.im

cybernato@exploit.im

demsocks@exploit.im

demsupport@exploit.im

dev.tenebris@exploit.im

dumpstv@exploit.im

ideal _docs@exploit.im

magicbot@exploit.im

numerik53@jabb.im

oliviam@creep.im

procrd@exploit.im

rothschildgroup@exploit.im

rumarket@exploit.im

sales.linkensphere@exploit.im

workforbtc@jabb.im

Stay tuned!

1. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEju2QxZnNWPde-ihVbXwrep9YhFNp4WvzKTX3gLP_KYa0lS4

e5fFULsTzO2cuFxf124f7x_mi6Kq7_JZTeuMa5cMFJqYdRvOIt7Rge

1.6.10 Bed Time Reading Courtesy of the Bad Guys (2023-08-21 04:39)

[1]

1141



In need or a fresh set of URLs to check in your spare time courtesy of the bad guys’ "bed time"

reading department?

Check out my recent compilation which basically consists of all the URLs found on a popular invite only cybercrime-friendly forum community and happy reading and improving your situational awareness in the field in terms of what are the bad guys up to in terms of improving their situational awareness in the field and what are they up to in terms of what are they working on.

Sample URLs include:

hxxp:// # # # # # #.conceptcar.ee/maybach/exelero/index.html

hxxp://0.0.0.0:8080/irJaH9rEib2

hxxp://002.kiev.ua/pictures/canon-eos-40d-kit-17-85 _b.jpg

hxxp://0day.altive.info/gourl.php?hxxp://rapidshare.de/files/25290900/MIRKO _CRO _COP _FILIPOVIC _VS _SHUNGO _OYAMA _by _0din.av

hxxp://0day.altive.info/gourl.php?hxxp://rapidshare.de/files/25317660/MARK _COLEMAN _VS _

_MIRKO _CRO _COP _FILIPOVIC _by _0din.a

hxxp://0day.altive.info/gourl.php?hxxp://rapidshare.de/files/33499747/Mirko _CroCop

_Fil-

ipovic _vs _Bob _Sapp _K-1 _World _GP _2003 _in _Saitama _by _0din.avi hxxp://12.150.231.6/binlist1.rar

hxxp://127.0.0.1/index.php?option=com _mediaalert &id=

hxxp://127.0.0.1/index.php?option=com _pressrelease &id=
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hxxp://www.justice.gov/opa/press-release/file/1032021/download

hxxp://www.justice.gov/opa/press-release/file/1084306/download

hxxp://www.justice.gov/opa/press-release/file/1084311/download

hxxp://www.justice.gov/opa/press-release/file/1084316/download

hxxp://www.justice.gov/opa/press-release/file/1163066/download

hxxp://www.justice.gov/opa/press-release/file/1313656/download

hxxp://www.justice.gov/usao-dc/us-v-thomas-mccormick

hxxp://www.justice.gov/usao-edny/pr/russian-citizen-indicted-15-million-cyber-t ax-fraud-scheme

hxxp://www.justice.gov/usao-edny/press-release/file/1114576/download hxxp://www.justice.gov/usao-edny/press-release/file/1158741/download hxxp://www.justice.gov/usao-ndca/press-release/file/984661/download hxxp://www.justice.gov/usao-ndga/pr/major-cyber-criminal-extradited-czech-rep ublic-face-charges-atlanta

hxxp://www.justice.gov/usao-nj/pr/ukrainian-citizen-sentenced-41-months-prison- using-arm hxxp://www.kaspersky.ru/blog/spam-through-google-services/22834/

hxxp://www.lancaster.ac.uk/staff/wangz3/publications/ccs18.pdf

hxxp://www.linkpicture.com/q/

hxxp://www.mazafaka.info/member.php?u=4266

hxxp://www.memberconnectweb.com/cgi-bin/mcw373.cgi?MCWSTART

hxxp://www.metasploit.com/redmine/projects/framework/repository/entry/modul es/exploits/windows/browser/apple _quicktime _marshaled _punk.rb

hxxp://www.metrobankdirect.com/corporate.asp

hxxp://www.metrobankdirect.com/default.asp
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hxxp://www.mitre.org/sites/default/files/publications/14-2221-extreme-escalat ion.pdf hxxp://www.mpt.gov.by/ru/news/04-01-2021-6948

hxxp://www.my.commbank.com.au/netbank/action.do

hxxp://www.my.commbank.com.au/netbank/confirm-transfer

hxxp://www.nassiben.com/lamphone

hxxp://www.nationalcrimeagency.gov.uk/news/hacker-from-russian-crime-group-jailed-for-

multi-million-pound-global-blackmail-conspiracy

hxxp://www.ndc-system.com:21332/

hxxp://www.ndc-system.com:21332/ccicq.html

hxxp://www.ndc-system.com:21332/ccicq/cc.asp?lang=eng

hxxp://www.ndc-system.com:21332/ccicq/cc.asp?lang=rus

hxxp://www.ndc-system.com:21332/ccicq/cc _en.html

hxxp://www.ndc-system.com:21332/common/getccicq.asp

hxxp://www.ndc-system.com:21332/common/getccicq.asp?lang=rus

hxxp://www.ndc-system.com:21332/esp/index.asp

hxxp://www.ndc-system.com:21332/files/ccicq/pack/themes/ccico.dll

hxxp://www.ndc-system.com:21332/misc/icqlog.flv

hxxp://www.ndc-system.com:21332/misc/kiborg.mp3

hxxp://www.ndc-system.com:21332/ndcr/ndcup152.exe

hxxp://www.ndc-system.com:21332/ndcr/ndcup153.exe

hxxp://www.ndc-system.com:21332/pic/cicq/cfg1.png

hxxp://www.ndc-system.com:21332/pic/cicq/cfg2.png

hxxp://www.ndc-system.com:21332/pic/cicq/cfg3.png

hxxp://www.ndc-system.com:21332/pic/cicq/cfg4.png

hxxp://www.ndc-system.com:21332/pic/cicq/cfg5.png

hxxp://www.ndc-system.com:21332/pic/cicq/cfg6.png

hxxp://www.ndc-system.com:21332/pic/cicq/cfg7.png

hxxp://www.ndc-system.com:21332/pic/cicq/cl1.png

hxxp://www.ndc-system.com:21332/pic/cicq/cl2.png

hxxp://www.ndc-system.com:21332/pic/cicq/cl3.png

hxxp://www.ndc-system.com:21332/pic/cicq/cl4.png

hxxp://www.ndc-system.com:21332/pic/cicq/cl5.png

hxxp://www.ndc-system.com:21332/pic/cicq/cl6.png

hxxp://www.ndc-system.com:21332/pic/cicq/cl7.png

hxxp://www.ndc-system.com:21332/pic/cicq/ctip1.png

hxxp://www.ndc-system.com:21332/pic/cicq/ctip2.png
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hxxp://www.ndc-system.com:21332/pic/cicq/ctip3.png hxxp://www.ndc-system.com:21332/pic/cicq/ctip4.png

hxxp://www.ndc-system.com:21332/pic/cicq/fakehist.png

hxxp://www.ndc-system.com:21332/pic/cicq/inf.png

hxxp://www.ndc-system.com:21332/pic/cicq/msg.png

hxxp://www.ndc-system.com:21332/pic/cicq/msg2.png

hxxp://www.ndc-system.com:21332/pic/cicq/ssilist.png

hxxp://www.ndc-system.com:21332/pic/cicq/vlists.png

hxxp://www.ndc-system.com:21332/pic/logo/ndc _seif _nahui5.jpg

hxxp://www.ndc-system.com:21332/rus/doc/faq.asp #update

hxxp://www.ndss-symposium.org/wp-content/uploads/2019/02/ndss2019

_01B-4

_Schwarz

_paper.pdf

hxxp://www.netbank.ru

hxxp://www.nikkei.co.jp/nikkeiinfo/en/news/release _en _20191030 _01.pdf hxxp://www.novayagazeta.ru/articles/2017/07/18/73156-sotrudnik-yandeksa-pridu mal-makiyazh-obmanyvayuschiy-algoritmy-raspoznavaniya-lits-i-svernul-proekt hxxp://www.nytimes.com/interactive/2019/04/13/us/google-location-tracking-pol ice.html hxxp://www.openssl.org/ bodo/ssl-poodle.pdf

hxxp://www.paypal.com/cgi-bin/webscr?cmd= _display-approved-signup-countries-outside hxxp://www.paypal.com/es/cgi-bin/webscr?cmd= _login

hxxp://www.paypal.com/securitykey

hxxp://www.peace4peace.com/forum/member.php?u=445

hxxp://www.pentestpartners.com/security-blog/burning-down-the-house-with-iot/

hxxp://www.pgpru.com/novosti/2008/kriticheskajaujazvimostjvtruecrypt51/

hxxp://www.phe.gov/Preparedness/planning/405d/Pages/hic-practices.aspx hxxp://www.politie.nl/nieuws/2020/april/10/03-politie-houdt-verdachte-aan-voo r-ddos-aanval-op-mijnoverheid.nl.html

hxxp://www.preempt.com/blog/drop-the-mic-2-active-directory-open-to-more-ntlm -attacks/

hxxp://www.preempt.com/blog/drop-the-mic-cve-2019-1040/

hxxp://www.prnewswire.com/news-releases/wawa-provides-customer-update-on-previo us-data-security-incident-300994792.html

hxxp://www.psbankremotebanking.com.ph/?txtEncData= %C3 %C3 %92+ %ABE %B1 %F4

%C9 %85 %CB %D6p %E7X %

hxxp://www.psbankremotebanking.com.ph/login _page.asp

hxxp://www.rbnz.govt.nz/-/media/ReserveBank/Files/data-breach/kpmg-incident-ass ess-ment.pdf

hxxp://www.romanvega.ru/2020/02/3w3rr-air-mobile-2020.html
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hxxp://www.sec.gov/litigation/litreleases/2015/lr23345.htm hxxp://www.sec-consult.com

hxxp://www.sec-consult.com/en/Vulnerability-Lab/Advisories.htm

hxxp://www.secretservice.gov/data/press/releases/2018/18-SEP/CMR _48-18 _Extradition _of _Russian _Hacker.pdf

hxxp://www.secura.com/uploads/whitepapers/Zerologon.pdf

hxxp://www.securitylab.ru/news/492307.php

hxxp://www.securitylab.ru/news/510725.php

hxxp://www.securitylab.ru/news/526780.php

hxxp://www.securstar.com

hxxp://www.sendspace.com/file/4vb6b0

hxxp://www.sentinelone.com/labs/lockbit-ransomware-side-loads-cobalt-strike-b eacon-with-legitimate-vmware-utility/

hxxp://www.sjm.com/

/media/galaxy/product-catalog/f/d/fdc54111-9f48-4427-8deb

-

1fd29a815d04.jpg

hxxp://www.solbank.com/

hxxp://www.stolenidsearch.com/

hxxp://www.sunnbnj.com/home/personal

hxxp://www.supercerthosting.com/nph-proxy

hxxp://www.svbconnect.com/auth/

hxxp://www.swarmshop.ws/

hxxp://www.swift.com/sites/default/files/files/swift _bae _report _Follow-The %20Money.pdf hxxp://www.tenhand.com/cgi-bin/nph-proxy/111110A/uggc://jjj.tbbtyr.qr/

hxxp://www.tessco.com/products/displayProducts.do?groupId=345 &amp hxxp://www.tessco.com/products/searchProducts.do?validations=nn %7CsearchText &amp hxxp://www.theverge.com/2018/8/22/17716622/sec-business-wire-hack-stolen-pres s-release-fraud-ukraine

hxxp://www.theverge.com/2021/6/15/22535123/microsoft-windows-11-leak-screensh ots-start-menu

hxxp://www.torproject.org/projects/torbrowser.html.en

hxxp://www.us-cert.gov/ncas/alerts/TA18-275A

hxxp://www.usenix.org/conference/usenixsecurity14/technical-sessions/presenta tion/costin hxxp://www.usenix.org/system/files/conference/usenixsecurity15/sec15-paper-zheng-

updated.pdf

hxxp://www.usenix.org/system/files/sec19fall _stute _prepub.pdf

hxxp://www.vendorsname.com/forum/member.php?u=723

hxxp://www.vendorsname.com/forum/showthread.php?t=1924
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hxxp://www.vendorsname.com/forum/showthread.php?t=3968 &amp hxxp://www.vendorsname.ws/

hxxp://www.vendorsname.ws/forum/showthread.php?t=1193

hxxp://www.vendorsname.ws/forum/showthread.php?t=3136

hxxp://www.vendorsname.ws/forum/showthread.php?t=36

hxxp://www.vendorsname.ws/forum/showthread.php?t=7535

hxxp://www.virusbulletin.com/conference/vb2018/abstracts/starving-malware-a uthors-through-dynamic-classification

hxxp://www.vmware.com/content/dam/digitalmarketing/vmware/en/pdf/pr

-

oducts/nsx/vmware-five-cyberattacks-without-ai.pdf

hxxp://www.vusec.net/wp-content/uploads/2018/05/glitch.pdf

hxxp://www.webtent.net/cgi-bin/printenv.pl

hxxp://www.welivesecurity.com/2017/06/20/machine-learning-eset-road-augur/

hxxp://www.welivesecurity.com/wp-content/uploads/2018/09/ESET-LoJax.pdf hxxp://www.WIRED.com

hxxp://www.wired.com/2016/10/internet-outage-ddos-dns-dyn/

hxxp://www.youtube.com/channel/UCbROHoWZ5s89islB1BXxCiQ

hxxp://www.youtube.com/channel/UCTi _-vuap _zN01vEIfSK4yg

hxxp://www.youtube.com/embed/qZFzuHNqazo

hxxp://www.youtube.com/watch?v=3G5NXGMLKvE

hxxp://www.youtube.com/watch?v=3VIbPSPN8jE

hxxp://www.youtube.com/watch?v=4IvuxWaMcSY

hxxp://www.youtube.com/watch?v=5eDNuLSoHrM

hxxp://www.youtube.com/watch?v=5l6kYuzc4G0

hxxp://www.youtube.com/watch?v=6Chp12sEnWk

hxxp://www.youtube.com/watch?v=6QSsKy0I9LE

hxxp://www.youtube.com/watch?v=7ZEgEmu1q8k

hxxp://www.youtube.com/watch?v=8HZ4DnVfWYQ

hxxp://www.youtube.com/watch?v=8IJxO44kq24

hxxp://www.youtube.com/watch?v=a1dgOO9bALA

hxxp://www.youtube.com/watch?v=bDIQQjwWlWI

hxxp://www.youtube.com/watch?v=Bi602yAIBAw

hxxp://www.youtube.com/watch?v=bKgf5PaBzyg

hxxp://www.youtube.com/watch?v=dl1BJUNk8V4

hxxp://www.youtube.com/watch?v=dT9y-KQbqi4

hxxp://www.youtube.com/watch?v=eEHLWRxSaWo
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hxxp://www.youtube.com/watch?v=eypwjB2YouA

hxxp://www.youtube.com/watch?v=-f6pVayEYWw

hxxp://www.youtube.com/watch?v=gyHxYlmDKy4

hxxp://www.youtube.com/watch?v=HoSuLUtrkXo

hxxp://www.youtube.com/watch?v=huJcWoMWUlE

hxxp://www.youtube.com/watch?v=IJXLttI7BgE

hxxp://www.youtube.com/watch?v=ikZTNSmbh00

hxxp://www.youtube.com/watch?v=JyUsMLxCCt8

hxxp://www.youtube.com/watch?v=k28hFyMAj-o

hxxp://www.youtube.com/watch?v=kTtNX5Tmk3Q

hxxp://www.youtube.com/watch?v=l8YpnUsZqME

hxxp://www.youtube.com/watch?v=mREIeH _s3z8

hxxp://www.youtube.com/watch?v=mrzTTSGRjpg

hxxp://www.youtube.com/watch?v=MZ0nSO0WOJg

hxxp://www.youtube.com/watch?v=nuALDYPUgvA

hxxp://www.youtube.com/watch?v=o4WiC1ViUuI

hxxp://www.youtube.com/watch?v=phuiwh7djQM

hxxp://www.youtube.com/watch?v=PlgPSwwZc80

hxxp://www.youtube.com/watch?v=pQw2zRAqVnI

hxxp://www.youtube.com/watch?v=q _vo3NILiVs

hxxp://www.youtube.com/watch?v=QkGCP2mfbJ8

hxxp://www.youtube.com/watch?v=R2qcBWJzHMo

hxxp://www.youtube.com/watch?v=rhiSBc061JU

hxxp://www.youtube.com/watch?v=sGlrLFo43pY

hxxp://www.youtube.com/watch?v=tiy1K6-mf4s

hxxp://www.youtube.com/watch?v=U-TtobZXJcw

hxxp://www.youtube.com/watch?v=vP468ZjJ3hU

hxxp://www.youtube.com/watch?v=wiXaic6lOy4

hxxp://www.youtube.com/watch?v=-wmxo9zrXy0

hxxp://www.youtube.com/watch?v=WyU-gJ2NTGc

hxxp://www.youtube.com/watch?v=wzXA8TXfWq0

hxxp://www.youtube.com/watch?v=x6gB1hKjDys

hxxp://www.youtube.com/watch?v=XMOJP-Prrug

hxxp://www.youtube.com/watch?v=yXclNbox2ow

hxxp://www.youtube.com/watch?v=Z-AFsvnstM0
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hxxp://www.youtube.com/watch?v=zicM-5S9oaI

hxxp://www.zdnet.com/article/wawa-card-breach-may-rank-as-one-of-the-biggest-of

-all-

times/

hxxp://www.zerodayinitiative.com/advisories/ZDI-19-013/

hxxp://www1.bmo.com/cgi-bin/netbnx/NBmain?product=6

hxxp://www1.royalbank.com/cgi-bin/rbaccess/rbunxcgi?F6=1 &amp

hxxp://www2.fdicconnect.gov

hxxp://xakep.ru/wp-content/uploads/2019/03/212665/DMSniff-panel.png hxxp://xakepy.cc/showthread.php?t=65905 &page=1

hxxp://xakepy.ru/btwc

hxxp://xss.is/threads/61870/

hxxp://xxxxx.addr.com/cgi-bin/envcheck.cgi

hxxp://youtu.be/6soT3hZK _T4

hxxp://youtu.be/a1dgOO9bALA?t=1438

hxxp://youtu.be/jPRkjNDmTlc

hxxp://youtu.be/O9jf-RtpPXM

hxxp://youtu.be/Oh3qaqIq9MM

hxxp://youtu.be/ojigFgwrtKs

hxxp://zen.yandex.ru/media/devby/esli-pribyli-fbr-interpol-i-otdel-k-chtoto-u

-nih-na-menia-

est-tot-samyi-haker-iz-rechicy-vpervye-govorit-o-svoem-dele-5c62e 6f9d5594200aec79158

Stay tuned!

1. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEju2fwNFfgn8y65UAiU3km61Vllp8O8dfZaZxUXdcVXNlUCy

uC_8LxTfs9XjmQ4mIEqqK3tspCe9BcnhmBNHqfzbCj-4KHx-agdgFj

1.6.11 Exposing

a

Currently

Active

Personally

Identifiable

Cybercriminals

XMPP/Jabber Account IDs Portfolio - Part Three (2023-08-21 13:23)

[1]
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Folks,

This is the third part of the blog posts series where I’m actively data mining publicly and private invite only cybercrime-friendly communities looking for personally identifiable email address accounts and XMPP/Jabber account IDs with the idea to assist everyone on their way to properly do their research including the U.S Intelligence Community and U.S Law Enforcement on its way to properly track down and monitor the individuals behind these campaigns.

Sample XMPP/Jabber account IDs include:

1289ijay@gmail.com

283285287@protonmail.com

8888@thesecure.biz

abchospitalet@abcgrup.com

akshayvalunj7469@gmail.com

algemeenspam@gmail.com

alphv@01337.ru

amar.u1510@gmail.com

andy.tetley@gmail.com

antonio@crescimanna.net

antoniomarcos03@gmail.com

antonuemad@gmail.com

anupam.makum@gmail.com
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arslanyousaff@gmail.com

arunprakashnetwork29@gmail.com

asbjorn.lund.vestergaard@gmail.com

aspiring.pentester1@gmail.com

avenstewart@gmail.com

avos@strong.pm

avos@thesecure.biz

badaveapurva1@gmail.com

belay17@hotmail.com

belial-demons@exploit.im

belial-demons@thesecure.biz

big-bro@exploit.im

blackbytesupp0rt@onionmail.org

blackc0d3@protonmail.com

blocklocmedia@gmail.com

br0k3r@xmpp.jp

bratva@xmpp.cx

britekingb@gmail.com

camilonavarreteportino@gmail.com

ccarterdev@gmail.com

colucbuon222@gmail.com

compras.baleares@teclisa.com

consult@1jabber.com

contact@moses-staff.se

cuongjkne@gmail.com

cypher@jabb3r.org

darkswan@jabber.ru

dataman@0day.im

dataman@rows.im

derision.t@gmail.com

dhuciney@gmail.com

dzmitry.lukyanenka@gmail.com

Ekwunife15@gmail.com

engfog1337@gmail.com

epiceliteyt@calyxinstitute.org
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epiceliteyt@jabber.calyxinstitute.org

epiceliteyt@jabberix.com

ergenekon@jabbim.ru

erica@4dshop.com

esfinter0@gmail.com

f.cibien@gmail.com

froggy8x@gmail.com

gasbo52@yahoo.com

gautamjajwlya@gmail.com

geral@tracoactual.com

goyoguy1234@gmail.com

hack3dlikeapro@proton.me

harsh2astrotech@gmail.com

hassanelhoseny63@gmail.com

hippiejam@hotmail.com

hzllaga@gmail.com

Ig-dongremayur777@gmail.com

iludecosevilla@hotmail.com

indalica@gruponovelec.com

ira2429@yahoo.com

isjuye@gmail.com

jantonio.rea@gmail.com

Jareddarkweb@gmail.com

Jassimar777@gmail.com

jatinjena111@gmail.com

joelmathewbethel@gmail.com

kotiki@exploit.im

law7@verizon.net

lcmays@aol.com

learnharshnew@gmail.com

leopoldo787@exploit.im

lonnieastory@gmail.com

lusi@exploit.im

mallox@exploit.im

malvuln13@gmail.com
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matt.j.voss@gmail.com

matteopara@gmail.com

maxciencomp@gmail.com

michaeljonstevenson@gmail.com

midatlanticbeauty@hotmail.com

miguelpiccirillo17@gmail.com

mikes53976@aol.com

miscellaneous.ggg@gmail.com

mitchellgoffpc@gmail.com

moinkhanemon1997@gmail.com

mommy.jan@comcast.net

mssp@thesecure.biz

narek11harutyunyan@gmail.com

neizvestnost74@exploit.im

nicolasgomez.neg@gmail.com

nihateliyev203@gmail.com

nirvaxal@gmail.com

No _ESCAPE@exploit.im

ntooperstore@gmail.com

offdgrid187@xmpp.jp

ootkiller@thesecure.biz

oshinjainrocks@gmail.com

parkerbrothers66@gmail.com

pay2key@tuta.io

pharos@jabb.im

piratnetworks@jabb.im

princewael100@gmail.com

processor@thesecure.biz

pseudobytes@gmail.com

qzsue13@yahoo.com

rakeshlal.591c@gmail.com

rama.krish36@gmail.com

revanthshiva3@gmail.com

rickmuz@yahoo.com

robert.shoffner@gmail.com
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roki _h@yahoo.com

rootbytemx@gmail.com

rootkiller@jabbim.com

rootkiller@thesecure.biz

roshan.shrestha4u@gmail.com

rsmbloqueador@gmail.com

rwxrwxs@gmail.com

santanadacruz2001@gmail.com

sedmice@5222.de

segrastreamento@hotmail.com

seize@0day.im

serialwaffle.bb@gmail.com

seth@thesecure.biz

shriyan2001@gmail.com

skloveyou@yax.im

starspentest _team@exploit.im

stevestewart88@gmail.com

stormouss21@dnmx.org

support24@thesecure.biz

sylphN0va1337@protonmail.ch

test@snai.com

testsocks@faceless.cc

thomson.nj@gmail.com

tooperstore@gmail.com

Tvister@jabberes.org

vas.2sam@gmail.com

vent24tom12@gmail.com

vicesociety@onionmail.org

Vism@thesecure.biz

v-society.official@onionmail.org

vuldb@securityfocus.com

w1zard@thesecure.biz

willberich@thesecure.biz

yarabotyaga@jabster.pl

ymaulana10@gmail.com
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young _tx _bi@hotmail.com

yuvalyoav7@gmail.com

zhoua.dev@gmail.com

Stay tuned!

1. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEifks2zmhbWcRuSxH9xF-d0qS4VXHtV5qUC0jJhc4N-Hykbm

QCg1vi127zj6b0ZWNdNWqSNTLTuV5AGKVSYTAc4-UXV-KxRGc_ZRDJ

1.6.12 Where Is Anton Nikolaevich Korotchenko (Антон Николаевич Коротченко) Also Known as Koobface Botnet Master KrotReal? (2023-08-21 15:19) Who’s aware of his new VK.com account? Here’s [1]his user ID: mb9911 which I obtained using public sources. Happy research.

Sample photos:

[2]
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[3]

[4]
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[8]
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[16]
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[17]
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[19]
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[21]
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[22]
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[23]
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[24]
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[26]
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Here’s a full list of his VK.com friends:

Mikhail Tikhomirov

Sergey Gromykhalov

Alexander Smolentsev

Yulia Sergeeva

Dmitry Soshnikov

Nataly Rouf-Trubetskaya

Irina Vostroknutova

Svyatoslav Polynchuk

Ksenia Kuklina

Alisa Vorobyeva

Andryusha Palatnik
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Oleg Zubov

Kirill Shokin

Kristina Shustova

Svetlana Shantalova

Albert Urbanovich

Liza Tsarevskaya

Masha Vaulina

Dmitry Ogorodnikov

Alexey Kozlov

Anka Larikova

Vera Ivanova

Rituchcha Kuzmenko

Ksenia Orlova

Elena Sidorenko

Katka Karakatka

Vladimir Novikov

Egor Sorokin

Valeria Koturbach

Antony Fortonov

Danila Krivalev

Lyubov Shupakova

Vera Vorontsova

Borya Pogrebnyak

Andrey Pavlov

Maria Sharapova

Alexander YanovskyAl

Andrey Vorontsov

Elena Axyonova

Iya Skripka

Natalya Markova

Sergey Klimenko

Anna Kimstach

Elena Puchkova

Maria Udovydchenko

Yulia Lomakina
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Alexey Skripka

Maxim Tischenko

Liza Nikitina

Andrey Kuzmin

Elena Grigoryeva

Viktoria Nesterova

Alexander Shalin

Lena Demenok

Roman Kuzminov

Kakhi Alexandrovich

Irina Krotkevich

Roman Karelin

Zhanna Egorycheva

Kirill Gilev

Yana Polyanskaya

Alexander Krotov

Valeria Evdokimova

Anton Shamray

Yulia Mikhaylova

Artem Nikitin

Andrian Fedorov

Maria Lemzhina

Katya Filatova

Svetlana Polynchuk

Alexey Sobolev

Andrey Dovgal

Tatyana Voytyuk

Anton Shokin

Alexander Koltyshev

Ksenia Markevits

Inna Grigorschuk

Innochka Etuvgi

Roman Chernyakov

Villi Xxx

Andrey Smirnov
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Anton Nazarkin

Vasiliev Max

Olesya Gavrilenko

Alexander Efimov

Margarita Odegova

Oksana Sibirtseva

Vladimir Goryainov

Andrey Silin

Dmitry Sibirtsev

Tania BaikovaTania Baikova

Maria Gomolyako-Malyshkina

Antonina Sokirko

Petr MorozovPetr Morozov

Marianna KrelMarianna Krel

Alexander Amiragov

Vasily Evgenyevich

Vladislav Chumakov

Lena Titova

Evgeny Atamanchuk

Yana Gilyova

Yury Epishev

Pavel Zhelezov

Yulya Baboshina

Alexey Palkin

Kirill Kostrov

Ilya Shishko

Marina Musiaka

Anton Petryakov

Dmitry Vorobyev

Dmitry Tur

Marat Sayfullin

Natalya Korolkova

Alexey Ivanov

Natalya Sokolova

Evgeny Andreev
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Ekaterina Granich

Maria Mironova

Eldar Kambarov

Alina M-Va

Svetlana Shantalova

Gala Galkina

Anton Gusev

Yulia Voloshenko

Valeria Lyolya

Dmitry Sinitsyn

Alla Filimonova

Volodya Sokolov

Vadik Bichurinonline

Inna Kirichuk

Elena Liflyanskaya

Pavel Novitsky

Vladislava Gavrilashenko

Ekaterina Morozova

Sergey Ringzbenshteyn

Komu Kak

Alexander Arkhipov

Nadezhda Baranova

Anna Frejlev

Sergey Anatolyevich

Vladimir Demenok

Yana Tkachenko

Alexey Kolt

Ksenia Belyakova

Olga Varchenko

Sabira Pozdnyakova

Valeria Ovsyannikova

Maxim Melnichenko

Alexander Panaugye

Maria Panaugye-Karnaukhova

Olga Ivanova
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Maria Makarenko

Anna Avdeyko

Valentina Yavtukhovskaya

Denis Kurilov

Slava Nepriyatel

Ksenia Chertovikova

Stas Kozlitin

Andrey Levkovich

Oleg Opryshko-Pavlov

Vasily Tarabanko

Lidia Alexandrova

Yulia Nekhorosheva

Veronika Salikova

Zenit Spb

Nikita Podgorbunskikh

Olga Nagornaya

Dmitry Abramov

Margarita Andreeva

Roman Gorkov

Alexandra Nazarkina

Sergei Laptenok

Dmitry Momin

Katya Lipka

Yanka Ivanova

Alexey Gorbachyov

Alexey Opryshko

Kirill Zalata

Nina Ermolaeva

Elena Prisyagina

Oleg Savelyev

Katerina Erkhan

Alexander Doludenko

Maria Galyazimova

Yury Bochkaryov

Yulechka Kalishevskaya
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Sergey Zav

Delovaya Delovashka

Ded Mazai

Alexander Kiselev

Evgeny Vasilchenko

Denis Baranov

Evgeny Erofeev

Vladimir Dalgeymer

Alyona Doludenko

Stanislav Kolyada

Yulia Korolevaonline

Vlad Malorossianov

Alexandra Pavlova

Anton Karpushinsky

Shamil Guseynov

Grigory Ruzanov

Kirill Kalinin

Svetlana Skripkina

Elena Odinokova

Vladlena Smolyakova

Nikolay Korotchenko

Olesya Gridinaonline

Kirill Drobinkin

Maria Chalaya

Ivan Kalinin

Andrey Nekrasov

Anna Lyashenko-Dmitrieva

Yulia Fatyushina

Toshik Shestopalov

Evgenia Zarkhozashvili

Mikhail Klimenko

Alexander Bodrov

Rafaella Etranger

Denis Lyashenko

Ksenia Susleganova
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Elena Koryagina

Anastasia Sergeeva

Olesya Kuprina

Anastasia Rozganova

Anna Lemke

Vita Lika

Oleg Ivanov

Lyudmila Zhukova-Sverlova

Andrey Solovyev

Vera Kostyal

Anna Rudeva

Maria Izvekova

Lena Izvekova

Nikolay Logashenko

Valery Fudin

Villi Xxx

Evgeny Lisienko

Anton Baratov

Brave Lion

Viewtalay Fedorov

Grant Babinyan

Mir Bell

Valeria Rozganova

Pavlik Pavlik

Stanislav Nazarenko

Evgeny Net

Natalya Voytenko

Fyodor Providensky

Anton Reutov

Kirill Petrakov

Natalia Kuleshova

Roma Bochkarev

Dmitry Basov

Arvind Rasta

Alexander Karelin
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Viktoria Safronkina

Aleks Skela

Vitaly Kashapov

Pavel Lemke

Natali Natali

Yulia Ten

Tatyana Lyashenkoonline

Roman Bochkarev

Anna Lemke

Stay tuned!
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1.6.13 The Top Management of the Conti Ransomware Group’s Fashion and Charity Brands (2023-08-22 09:36)

[1]
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Remember my real time OSINT [2]analysis of the Conti Ransomware Gang’s internal leaked communication?

Here are some additional details on the Top Management of some of their fashion and charity brands obtained using public sources.

[3]
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Second image:

[4]
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Top Management Team Members of the Leylo Fashion Brand:

[5]
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Second image:

[6]

1381



Sample Photo of their charity fund’s top management:

[7]

Stay tuned!
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2. https://ddanchev.blogspot.com/search?q=conti+ransomware&x=0&y=0&

3. https://blogger.googleusercontent.com/img/a/AVvXsEgTCtpFVsHUfy3MVrmYSPM2qGBaSy9bXgw6MExEZA8mpdgjgOFwqJ8h5V

Lf9zGpaUNbUO5pObmlT0Uf8-TMuvjJ3d7bbKGbK2sXqKCo-w4bjNDv

1382



4. https://blogger.googleusercontent.com/img/a/AVvXsEjL35KbsIsN0aUwSMME9n_l8ErxBABcnKX8N-UNKbF6zr-SxxQz-wN6AV

dEukej-8mKySSwlFs3nDQGouSyMp7U3HmDyMIf7pPUolC8Y4xlZg8O

5. https://blogger.googleusercontent.com/img/a/AVvXsEhcjO0A6g6Iemm9ysVx4V-aGWXB08KK_adWLBaGH230FADdO9c9TM8QBM

033W6_wB_gTXWM9p6OR0UCjifXFNNDKu-2ihJwlmst__VsYnsJYVXr

6. https://blogger.googleusercontent.com/img/a/AVvXsEj4ExCEtQCH63e5mVKnzkgEh8SgcQAHmxceaWTJ8eG6-vqCaiFongbF4z

VLRKrG7v95TKuRLWOVh3EyNYazx46qz-is-l8L8cz0MYCfsM3Z0Z_O
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1.6.14 Joining Abuse.ch’s Malware Bazaar Platform (2023-08-24 13:25)

[1]

Folks,

I’ve recently [2]joined Abuse.ch’s Malware Bazaar Platform with the idea to share my actionable intelligence with the rest of the security community on a daily basis.

Sample photos:

[3]
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[4]

[5]
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[6]
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Stat tuned!
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5. https://blogger.googleusercontent.com/img/a/AVvXsEg6IkteU6AsAEBVpU2Vn0Gm0Chsiu_TnGhbkbShfRSrFxWFo21Y-_SZkb
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1.6.15 Who’s Behind the Conti Ransomware Gang? (2023-08-27 18:35)

[1]

Re-defining the basics of real-time OSINT?

Here’s how it’s done. Obtain quick access to a recently leaked internal communication courtesy of a major ransomware gang. Quickly attempt to data mine it looking for personally identifiable email address accounts and URLs then automatically visit these URLs and produce and publish high quality analysis on who’s behind the Conti Ransomware Gang.

Here’s the analysis:

[2]
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[3]
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[4]
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Leylo Fashion Brand

Top Management:

[5]
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Danil Ermolaev

ДАНИЛ ЕРМОЛАЕВ

hxxp://vk.com/id4874860

Birthday: 7 August 1989

[6]
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[7]
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[8]
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Maria Ermolaeva

hxxp://vk.com/id7326657

Birthday: 5 July

Благотворительный Фонд «Импульс к жизни»

[9]
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hxxp://impulse-life.ru

- ТАМИЛА КЕРИМОВА - ВИЦЕ-ПРЕЗИДЕНТ БФ

- Birthday: 4 April 1986

- hxxp://vk.com/id6515862

- Planet for beauty and development

- Планета за красоту и развитие

[10]
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[11]

[12]
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[13]

[14]
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[15]
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[16]
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[17]
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[18]
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[19]
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- ЛЕЧИ САИДОВИЧ БАКАНАЕВ - ВИЦЕ-ПРЕЗИДЕНТ БФ
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[20]

[21]

[22]

[23]
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- АЛЕКСАНДР ШИЛОВ - ПРЕДСЕДАТЕЛЬ ПОПЕЧИТЕЛЬСКОГО СОВЕТА

- Председатель-Попечительского-совета

[24]
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[25]

Ирина Верхуша

- ĥxxp://irinaverhusha.com

[26]
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Тел: +7 926 536-63-68

Email: impulse.life2020@gmail.com

Related photos:

[27]
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Stay tuned!
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U1hYOW2RiEY2Z8jYG71QH687ROZeTm17m1ei1lBv4m4lMCpSBaoSph

5. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjwCyjVPLU-sckx84czRtSIHzK2tLeNr4LFMEHLdHstLSKzg

Dn7_SKxnZiaNjG7E6eL2cwlqm1Riggs7UvS0v9so_3Vxh9ZmcwF7UM

6. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi0O2scrgk6rpP3kFot-2gcpb3J5f3jOXz7g0q4wlafTiBjL

Tsop-EzIfAzdaHKt7hOc8c67beq3wdBPVUV9OHCTq5ZA7sa-TzNiy3

7. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhIlyhj4zLoxqj5iHqRD6MUH3iBZsskor8QPGYCVRJfUvO1r

jD5Jb4f3sY2-hTy9fR0iCe9TZKG7CZ5EODqQbHQsyr25xBtBkT3CI8
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8. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhCSKkOKnwoaiifTqdhmtsAYz-9qiBVKVIRbWr7HfGku0hUA

jUPwvoZYK5STFTMt6VzAJBuOjJRt3onUqE9Q85gHPsJHbLpexMLq4y

9. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgLjBvoASUQPsnlSdD9I_3MubHebo-8Xz0SAsNtJkNwWRVGf

zjCOYnVlOdzwiMn5ZL5wWcBSYJexs-EgwXLe8gVPcxbyhBxLo25MGP

10.

https://blogger.googleusercontent.com/img/a/AVvXsEg96FKGttLboCgMFWzlFq3QSZsJ7Eh7W2Gk7fE0XusEUjkffMjJoiw1

Febm_p_6hrMwhAzSBpYWW0oirm5mJASK2hAbYuDE8lWGkISPx51V2LGg

11.

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjn9JazRTpzCITH9J8CZV6Ft9gxg43a1dxgZHjcu-IGdkk

IPRi2rgXpL4cakeD_HT9P7xOQDK9br22IaEqE5Sanyx8-oAZL2VveYaC

12.

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhH63aVfD2jYYC9a5JroPbNtYu_Nzuor95HnWfuoU-E3xK

IUrBAyp9qo9Pj6UfjDAUIGCnY4j9UXBXbNh4wCuLq4-MXX8-3cVoSfwU

13.

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhxZBtMwXJhg1gjdA5UiNHnNyU8WasCkMIgiSfuk-kFzD4

6pn7nYt-ErnbCUPHiTXpQbOkcKSpSpf3S59CKIbD2zfg2Mk4RNDVw1N2

14.

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhNl2293rnXBoG23pEwFuo0FTIisKUkAfQWT3l2v5gyAao

F5KxqrAoLagTczOJaxolUY256-edkNEOn_UkB77ueFeBWE-ywr19MCUy

15.

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiQB9WM2wW7n9Y5YSJ5aAXWql-oEjrC2QdZmaxyw4HiCJ4

TwC0vRt3d6ovFmFZVZvPx2XJ5R1yW970vWTCGhYmsLVyjTaC-xOhLwol

16.

https://blogger.googleusercontent.com/img/a/AVvXsEggAC69a1YNFxi7RxR8wosyVB6lKb86v8qfaYL7B_3fMQdiNn1JjRYu

BUIGuqcemlqGXtavWrXKIfJGigWGawbvCzu4j7kp-_gwiKSzY2Ojby3L

17.

https://blogger.googleusercontent.com/img/a/AVvXsEgiORcOB66k2YMxuHOe1VZqvvsGt_ET3EeLuPaJYrTMbpHoipYaBtH-

Pw0jFQn4gUgG8UdnzXKJtYdhQaUKC_Gx80sYpYZnwhz4L8QIWo-QvlCe

18.

https://blogger.googleusercontent.com/img/a/AVvXsEjgiMMgFExe-6p6bo5yQCp8I5K2Sf0sxRmU1cQWkEhxIqaNqXq1kUkK

hk6sJy-lUbXGar2OSoO_HvmulOoaNiasw6EnHH05GRgWF9DowkB_TVJy

19. https://blogger.googleusercontent.com/img/a/AVvXsEiGUW5970TSwkVsOcrSTzKpj11C93t3vxYYhrwZGElYrYZWikl--ctW

q_dZjvBiFpchrKIriMUSHla0Hd3SMP7tP2lMPOtKLQdscWxQS8F6wx0K

20.

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhH7__5CdHltMONqvrHXvAYdIdqoyDB5DWNxrJSIlFQQNk

kawBVXiDOezvEXQzEfHw8kH61vXGNRHZdERnXp_ammE3eYpZiGYLVHrA

21.

https://blogger.googleusercontent.com/img/a/AVvXsEj36oqTDIYb7SDDj892VzOO_vEJSNN254tQdTNCkCmxJNmLRBtnUSwm

qOm-SOZV1CGlNNif8x9Yq3r8sH3JoM3HxE3OMc9scZD7dNBoVhxi1vmB

22.

https://blogger.googleusercontent.com/img/a/AVvXsEiaEdvAdcnMCMYy00OTXV6SZzve_anJdFUB9bXxE1xL6AWG3vVNwTvv

kU3r7vcSLfUQ4jLiur8F8uMv14_bqmavsUosf1f8dqq2pi0xXk4mIGZg

23. https://blogger.googleusercontent.com/img/a/AVvXsEh86U6suy7MYKH6G-dbGNNbBrgDp7CaZ4aMsNmTMwZ3M4MbPEdJ8gPq

otWtYTjzsXPLuyZQxKGASIXmJTFUPw9OYHfJQYp38EYtqR4-Gir8xvXN

24.

https://blogger.googleusercontent.com/img/a/AVvXsEhl02cr6Z0h3wD7lhP9AsJ0yeooZdoBZRSORXzRWllN9Duerkhux1dq

Zh6CW_bOftBpw_Sl_YgMfvikWQrwg7rqCEmt-92Ms5qLJ9osuANJm_3-

25. https://blogger.googleusercontent.com/img/a/AVvXsEi4H3MXkbNtOzWLGhSyvox3D-L_Qfo08DSoHVFgi2OR7VNeJ2GM-1Ut

L1RxBSzYBhtIKdlQ4cCn6NQvla_nFvLgMgRV1kXq00MUF964bcJCP7Q6

26. https://blogger.googleusercontent.com/img/a/AVvXsEhwSfmuZshf6owNKNowR9N4fDToxgEym6C8D1MD_tJSgyv05efgb1-T

QEuligm6eF8PHp3fnyIDQhwpaw_qHzj8NSVYEupAJ44KidHdZEkUCRAh

27. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgbtr-P0PxGMe6f6Kw2MekzkrlWJYu2KW37Z1KBjs8B4EJ

jvNBhOfGeJjGlpxu8gkIBfpsibBdGw-hW_r6vC-UoH_rpACAPuPEzDGX

1.6.16 About to Get Featured In a Popular Cyber Security Magazine (2023-08-30 11:26)

[1]
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Dear folks. I’m about to get featured in a very prestigious cyber security magazine in a very prestigious edition. Unfortunately as I’m slowly transitioning into becoming an independent contractor again where most and the best of my research comes from I’m practically broke and I might need your assistance here. Anyone up to assist and support me here? Drop me a line and I’ll explain - dancho.danchev@hush.com

Stay tuned!

1. https://blogger.googleusercontent.com/img/a/AVvXsEgoYgR9lcnVBQpFzHewtFqlAKEDdTTDJXSrV6f05k1Y_OeHXt6PmhYKu0

truo5wuCudPDQR6U9q6fYs4Q0U8jn0wR-O_HIsDdUf1EE9heLZelMP

1.7 September

1.7.1 A Psychological Profile of Nicolay Sabchev/Nikolay Subchev Troyan, Bulgarian, A Wannabe Psychedelic Trance DJ - Part of the "Local Diships Gang" - From the Awesome But I Smell Like Dipshit Department - An Analysis (2023-09-04 02:47)

[1]
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This is from the "I sincerely apologies for this post but you robbed beated and home molested me and stole $85,000 with your savages friends from your and my hometown Troyan, Bulgaria without anyone knowing that also includes the police" department post.

Does it smell like [2]dipships in Bulgaria or does it smells like dipshits in Bulgaria? Appreciate my rhetoric. It does but exactly where it does - in the toilet.

T-Shirt - $1

Haircut - $1

Equipment - $1

Sample photos:

[3]
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[4]
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[5]

[6]
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Total amount owed during the years for existence that’s so cool that cannot be appreciated due to logical and low life unappreciated existence where even nature cannot help you to "get high" - $0. How come?

That’s life.

1. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhm7mvHCcYxZW4wf82cRxW-BgLcHjtE1x24HCvdljiOyzfCf

wjqZEPjIrMS1VgVzMEszZ-YnoLyCSaXL6I-TVmurK6tjmqceaSyu64

2. https://linkedin.com/in/nikolay-sabchev

3. https://blogger.googleusercontent.com/img/a/AVvXsEg3KiA3ZjmIEhhQpCgeIFli05XEWIzmxCDnH3hzA5KNG9dANRrmi2otZZ

QAyyL7nwAG0Sbb304tRDXUkExjvjkFinhJWTm_owCGjB-p6BqjGcmG

4. https://blogger.googleusercontent.com/img/a/AVvXsEhcWGhsp3R00A0q3E6IBNy3MrQJLL119tbl0eki6TZivbOUlRAdP8zV2C

8SQn6FrBGYnYNitac7c6HAD6Xd0l-Uw4GhSDzRXk6FFiZWbf7vi-rz
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5. https://blogger.googleusercontent.com/img/a/AVvXsEiuiuVj3UhlqNy46eF_RFnaddwyzKmwhsfefvGcrnsJezs3XL78Z7uTPt

ujO3Lzi20M1QwXY8UlfVOTpbPT2hhOn5neI2bmtEwGOwL9UVa-Q7u_

6. https://blogger.googleusercontent.com/img/a/AVvXsEikuP3xmBtyTlVgepzw_7xc4UZhwzR1vW74BcwxuOAt0OtQ18cwC788po

GBgMhqrQKTwFZQE_ZgD3dzrnMeM1g2yPeNx8PUKpjsQKmlOiz05hfP

1.7.2 Yavor Kolev (2023-09-04 02:48)

[1]

Is it a King or it Gypsy? No, it’s [2]Yavor Kolev. Gypsy Kings to the bottom of your brain’s out.

Stay tuned!

1. https://blogger.googleusercontent.com/img/a/AVvXsEjmVolaWd0ff1lycQvhOtgUdAmOj3vPPzX12OjHjr6jUcmp5t03Q2zYHH

5NzuBnOClCkNWVqFyGES5zMquT0lYQCFmfzYlAlOES6sgiwjwRYrPp

2. https://linkedin.com/in/yavorkolev

1.7.3 The Conti Ransomware Gang and the Trickbot Cybercrime Enterprise XMPP’s and Jabber Account IDs (2023-09-08 14:07)

The power of OSINT and real-time OSINT which has been my methodology since December, 2005 when I originally launched this blog? Check out the following analysis courtesy of me which details in-depth who’s behind the [1]Conti Ransomware Gang and the [2]Trickbot cybercrime enterprise using exclusively and entirely public sources of information in combination with my real-time OSINT methodology hence the results.

[3]
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Sample XMPP and Jabber account IDs include:

LiamNeeson@jabber.ru

arb _reserved@ubuntu-jabber.de

battletoad@jabbim.sk

begemot _sun@jabber.ru

crazy _digger@jabber.ru

gfh6776@jabb.im

ivanalert@jabber.ru

landslide@jabb.im

new _henry@jabber.cz

scopehope@jabb.im

ugly@1jabber.com

valerius2k@jabber.ru

vdx17@jabber.ru

337788@exploit.im

asteradminn@sure.im

benalen@exploit.im

bio@yax.im

crunch@exploit.im

daiverjm@exploit.im

dmanager@exploit.im
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fuckUSAhahaha@exploit.im

fuckusa@exploit.im

gfh6776@jabb.im

goldcoin@exploit.im

jackiedugn@exploit.im

landslide@jabb.im

martiniden123@exploit.im

mr _loki@exploit.im

posi _tron@exploit.im

pravdazanami@exploit.im

rob0660@conversations.im

scopehope@jabb.im

soulst@exploit.im

time _t@exploit.im

trqa23rt@exploit.im

volhvb@exploit.im

yastreb@exploit.im

SamCodeSign@xmpp.jp

alieelu@xmpp.jp

baton@xmpp.jp

batono@xmpp.jp

benalien@xmpp.jp

cosm123@xmpp.jp

graddds@xmpp.jp

guliver@xmpp.sh

liamliam@xmpp.jp

ohmygod728@xmpp.jp

It gets even better with the recent [4]OFAC sanctions that also mention several interesting email address accounts:

volhvb@mail.ru

volhvb@live.ru

volhvb@yandex.ru

volhvb@gmail.com

rfonin@gmail.com

mfonin@jabber.ru

tsarev89@gmail.com
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megaprof@gmail.com

refflex@gmail.com

It gets even more interesting when we dig a little bit deeper and find related domain registra-tions associated with these email address accounts.

[5]

For instance we have hxxp://baikal-tour.su which is a travel agency and hxxp://kurochkina.com which is Ekaterina Kurochkina who is a fashion photographer currently known as Valentina Ushenina currently a training instructor at the PortDeBras company where we have the same domains registered by a known individual on the Conti Ransomware Gang’s sanctions list (megaprof@gmail.com).

We

also

have

a

Google

Play

application

(hxxp://play.google.com/store/apps/detai-

ls?id=com.WSCards.RSP & &gl=US) that also points to (hxxp://finters.su) which stands for an international sports organization.

Personally identifiable information on Valentina Ushenina include: Skype: valentinatigra

hxxp://vk.com/id3151577

Email: kyrochkina.sug@mail.ru; tkanikurik@yahoo.com

Sample photos of Valentina Ushenina include:

[6]

1418



[7]
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[8]
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[9]
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[10]

[11]

[12]
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[13]
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[14]
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[15]
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[16]

All known domains known to have been registered by megaprof@gmail.com include: hxxp://artfreegallery.us

hxxp://artfreegallery.com

hxxp://kurochkina.com

hxxp://s23.su

hxxp://baikal-tour.su

hxxp://finters.su

All known domains known to have been registered by tsarev89@gmail.com include: hxxp://art-deko.biz

hxxp://serpwomanhealth.info

hxxp://avtofortuna.info

hxxp://knigodvor.info

hxxp://alkommet.com

hxxp://art-deko.info

[17]
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Stay tuned!

1. https://ddanchev.blogspot.com/search?q=conti

2. https://ddanchev.blogspot.com/2022/03/exposing-trickbot-malware-gang-osint.html

3. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhEJNumGYh4JrXlnEKsXguRuzEwiWEx3Nl4sHRPbOSUvbDMQ

jvogldDLmlGYdIXicCxEUGIMlgsV6D_Hjwmg23np1xfcVjcL-F71W_

4. https://ofac.treasury.gov/recent-actions/20230907

5. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg-Knwr2AaawIX6lKDaVs2O3Oc6Q06lRa7LLIKVnV45pehrN

bUi7eZ_9d49pPuikuklO58daDCb8iAXXTgOnkjhWBGAsfUzj2MJmtZ

6. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEidNYd1AZM0JLhomT-CwMDKXhnknYagdazR0NMzB6D5xEXw8

fXxBFS5s6dTP3Surq0dQ3SxQGiYQVNiD0P8CQiT5mXFKb0ljBOIOTY

7. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiwe46lsiz6Ls15YPmx_pfXGi8XP9PZ6OPIZMDCVlqRehjdr

LFogZkCiUOsLMYwxDjEqSm4gk1uNJKYNTZO3cG0Nw3IvklZtST_uH7

8. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiVhX3qv7TyVvYth5-jWlD8VAmG9GykgOI40bGoOPW1YEfpB

V2-DR56_5ELFByyzjedb8C8O8O_ZVlPEA6i6ifT1fTuTYK2g2g6WCd

9. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgs2AKmGR61iXtNYn-5r2yVY2rAfHUC7koBDuUcwJa6A1-yY

LkNn-auFLYdV7L22eQH3PdqYjJdK8r1wRYQHWBmQ6poTzHguNi5bcb

10.

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhfyhMaOyuKBcHVo7SPCtzq7php3aGIHLxQtVr-DLTmCOQ

0JqLCdke_O9EL7Cd1zzFe84kOBbPO2OVXwSonHyVoG-dVnlXGtXH8wG1

11.

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhCwyBGwozh3BNdCaslItBhpGrtgwz4IfqBigRamrG_N7P

1v6NzPU3eV3DhsycnUooSEDOKj3xPaH7rElHfHNEQ6f_1gAVgNm4YSPR

12.

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiMBEPdk0kQj09r7rW1R01SoNVWHI9AVcEDrkm3vWPZ5Ex

2Eux9iS4z21Zs7RtWshiURB1Jtnyqi_Kj2VrdoR24CN5zq1P3lUErYq-

13.

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgIm86N6NsM5-hJ5ZM3xPQLwPdJckF9qxPAtdxMEZFSVxN

kHdvmx3t_JdmFKUD0vXVTlmPZyag4OzPIEv6fUlPbi1mAComg2doWXli

14. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgDKfgBM-yqgBrn1wJO3MgxTgAgBxWx3IW8La3zMo-ZwE9
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KS6lrTsAp7Nx1WPNodrFcGhhaLMum5kvKULL01StH_AB8wud1oAn50NI

15.

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjkTxDLOrgZAIuO3wxwqTL-njJoqXCQLbEYF8Gk4eiz5Rm

JJqqskBvTn0CVRELTQLROS6FE8vDlZWKAH5rsl3DM3baCtGMRxRYgumy

16.

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhtk8dqXe6su38RG28nWBbjrm0YQW97fvMJUqDRoO1FC28

QYYkIpNtNeLNZa9oqY1DDPRGRL1G_x6abn2MedHEeCb9ItCllwDM6O3i

17.

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhIeCXRu1mlQkWBHNlgCvouBqKfWs_uVCRE0R6cDA1J327

7IzdD1chOMcYtibri7h0lSDPGK3g5c70pQzb3ec2nV0Vh7ivSjaaPKVZ

1.7.4 Who Wants to Chat Privately With Me? (2023-09-09 14:47)

[1]

Who

wants

to

chat

privately

with

me?

I’m

using

OMEMO.

My

XMPP

ID:

ddanchev@conversations.im and this is my OTR danchodanchev@xmpp.jp 1. https://blogger.googleusercontent.com/img/a/AVvXsEjj3OfeN_ZPHDCu16BQ67PX6i5XTNLHhAm12_rnuDrYJzYOg1GEA1pQyG

6aWlqz5U8DfR7MmY6b7ZjgyxBmgj6cfxnIP40y6KlMzyz3O3GPBvWW

1.7.5 My Projects (2023-09-11 19:44)

[1]
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Dear blog readers,

Got time?

Check out some of my projects:

- [2]STIX/STIX2 OpenCTI Threat Intelligence and IoCs (Indicators of Compromise) Feed

- [3]Cybercrime Maltego Graph Hacker Database v1.0

- [4]Cybercrime Forum Data Set 2023

- [5]Offensive Warfare 2.0 - Central Clearing House for Threat Intelligence

- [6]OSINT Marketplace

Stay tuned!

1. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgPwcPVR-pSDcQEbVBmX1-y4xVq0gVadD-9Q2Vp-sPsEFoGE

bj9EY6PN7Qtea7eP8OKlR4SeHWhsUjaqPbD9Bz6m-7Fj7wBE9SHPp5

2. https://disruptive-individuals.com/

3. https://cybercrime-maltego-graph.org/

4. https://cybercrime-forum-dataset.org/

5. https://offensive-warfare.com/

6. https://osint-marketplace.org/

1.7.6 Sample Breach Forums Personally Identifiable Cybercriminal Email Address Accounts (2023-09-17 19:10)

[1]
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Dear blog readers,

The following is a personally identifiable email address compilation known to belong to known members of the Breach Forums cybercrime-friendly forum community which I’ve decided to share with the idea to assist researchers vendors and organizations including U.S Law Enforcement on its way to properly track down and monitor and prosecute the cybercriminals behind these campaigns.

Sample personally identifiable email address accounts of known Breach Forums members include:

bfweep[.]proton.me

elforumadept[.]proton.me

mybbjunkxd[.]protonmail.com

cry4mebb[.]proton.me

nathavm[.]proton.me

opsopsops123[.]proton.me

kokotc[.]proton.me

meowza.mlplove[.]proton.me
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megadabbz[.]protonmail.com

rhapsody3[.]proton.me

mixoleetou51[.]protonmail.com

x153[.]protonmail.com

cooncooncooncooncooncooncoon[.]proton.me

drugsarefree[.]protonmail.com

ciphergold[.]proton.me

unknownUser23[.]protonmail.com

Mafiosoyouth[.]proton.me

domainreportaa[.]protonmail.com

entrymeowmeow[.]proton.me

nicetryniggerkek[.]protonmail.com

an0n.pr1v[.]proton.me

C0rpix[.]protonmail.com

spumoni529[.]proton.me

researcher8293[.]proton.me

ImNotHere97[.]protonmail.com

yasinstinkt[.]proton.me

bestlonely[.]protonmail.com

nox-nicht[.]protonmail.com

mamamia.omega[.]protonmail.com

fbiareus[.]proton.me

raidblocker[.]proton.me

K.MRXx7[.]protonmail.com

xxxtenlive9[.]proton.me

wdwamfrpaws[.]proton.me

ByteNinja956[.]proton.me

verykindgentleman[.]proton.me
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lordisha[.]dnmx.org

kangarootc[.]dnmx.org

xnico[.]dnmx.org

brettjs[.]dnmx.org

doctorreal[.]dnmx.org

sicarius69[.]dnmx.org

akarca[.]dnmx.org

hellokitty234891[.]dnmx.org

Tklmaster[.]dnmx.org

Tarepanda[.]dnmx.org

Indishell[.]dnmx.org

redux[.]dnmx.org

install[.]dnmx.org

metasnapchat[.]dnmx.org

Metaforce[.]dnmx.org
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Ahmadxd[.]dnmx.org

Denisovich[.]dnmx.org

Rilakkumabear[.]dnmx.org

Jerrytom[.]dnmx.org

Roundearth[.]dnmx.org

Knight[.]dnmx.org

RoyalQueen[.]dnmx.org

Royalx[.]dnmx.org

Soulx[.]dnmx.org

DarknessX[.]dnmx.org

Ak47x[.]dnmx.org

Americax[.]dnmx.org

Crackedx[.]dnmx.org

123xd[.]dnmx.org

Cobrax[.]dnmx.org

Venomx[.]dnmx.org

deathxd[.]dnmx.org

4ttrs[.]dnmx.org

DarkxDeath[.]dnmx.org

DarkxKnight[.]dnmx.org

Evilx[.]dnmx.org

Hiccup[.]dnmx.org

Maleficent[.]dnmx.org

MiaK[.]dnmx.org

TopxG[.]dnmx.org

LuciferD[.]dnmx.org

shirokun[.]dnmx.org

Crackx[.]dnmx.org

DarkAli[.]dnmx.org

OnnichanUwU[.]dnmx.org

karatekid[.]dnmx.org

KhanB[.]dnmx.org

iame[.]dnmx.org

smartelog[.]dnmx.org

audiencele[.]dnmx.org
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iw991ia[.]dnmx.org

damemphis[.]dnmx.org

GoogleX[.]dnmx.org

IBM[.]dnmx.org

breachedvc[.]dnmx.org

MicrosoftPVT[.]dnmx.org

FRS[.]dnmx.org

GunX[.]dnmx.org

KID[.]dnmx.org

Toothless[.]dnmx.org

TEN[.]dnmx.org

CoinX[.]dnmx.org

DemonXd[.]dnmx.org

Asadx[.]dnmx.org

VxPN[.]dnmx.org

MetaFacebook[.]dnmx.org

DOGx[.]dnmx.org

GrandTheftAuto[.]dnmx.org

Kingxpin[.]dnmx.org

TigerXd[.]dnmx.org

LostX[.]dnmx.org

Bing[.]dnmx.org

DiscordPVT[.]dnmx.org

YouTubePVT[.]dnmx.org

CID[.]dnmx.org

TheUFO[.]dnmx.org

DeadWarrior[.]dnmx.org

DeathWAR[.]dnmx.org

kilink[.]dnmx.org

alabmoah[.]dnmx.org

dejvbweiojdvbjwbid[.]dnmx.org

PoliceDepartment[.]dnmx.org

KingLEO[.]dnmx.org

KhanG[.]dnmx.org

MrBeastYT[.]dnmx.org
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SusAf[.]dnmx.org

Man[.]dnmx.org

ImKSZ[.]dnmx.org

Mojang[.]dnmx.org

TeslaX[.]dnmx.org

HailHydra[.]dnmx.org

Eboy[.]dnmx.org

EboyAli[.]dnmx.org

NeganSmith[.]dnmx.org

REDS[.]dnmx.org

TheWalker[.]dnmx.org

PTI[.]dnmx.org

YukariX[.]dnmx.org

AssWipe[.]dnmx.org

Fury[.]dnmx.org

She[.]dnmx.org

Evex[.]dnmx.org

VEX[.]dnmx.org

BreachVC[.]dnmx.org

0293848811[.]dnmx.org

Assassin[.]dnmx.org

Ezio[.]dnmx.org

UnitedStates[.]dnmx.org

Asian[.]dnmx.org

Asiax[.]dnmx.org

Mammal[.]dnmx.org

RexT[.]dnmx.org

Avoslocker[.]dnmx.org

Rhino[.]dnmx.org

tz002mail[.]dnmx.org

Pythx[.]dnmx.org

xBoss[.]dnmx.org

mouly[.]dnmx.org

Mailmx[.]dnmx.org

CyberD[.]dnmx.org
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MailG[.]dnmx.org

NixOS[.]dnmx.org

ShinyHunter[.]dnmx.org

cap[.]dnmx.org

Swordx[.]dnmx.org

egirl[.]dnmx.org

TheISIS[.]dnmx.org

TheBible[.]dnmx.org

TheVirus[.]dnmx.org

Shoutbox[.]dnmx.org

Force00[.]dnmx.org

babyl0n[.]dnmx.org

Thorodinson[.]dnmx.org

1. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgFfh8bHP83eIiK8kzJJZHeE1FT7P9mHfBZ3FCRrO4MmkFwv

XlUk5Bs_TKQ96Y3FoInSBnCJQCxKX8HhNIguAzyJFctXfpZwJrjTYr

1.7.7 Sample

Personally

Identifiable

Cybercriminal

XMPP/Jabber

Accounts

(2023-09-17 19:10)

[1]

Dear blog readers,

The following compilation of XMPP/Jabber account IDs known to belong to cybercriminals which I obtained using public and proprietary sources including data mining aims to assist researchers vendors and organizations including U.S Law Enforcement on its way to properly track down and monitor including to prosecute the cybercriminals behind these campaigns.

Sample XMPP/Jabber accounts IDs known to belong to cybercriminals and known to have been involved in various campaigns include:

newjabber@jabbim.com

cash@allinione.com

slark@jix.im
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sypress@wwh.so

soft-rdp@xmpp.jp

merchant.official@xabber.de

merchant.official@jabbim.com

driesdtt@in.koderoot.net

npaplav000k@strong.pm

npaplav000k@xmpp.jp

cashsir@xmpp.jp

luke@allinione.com

nsky@allinione.com

adm@allinione.com

mrgreen@allinione.com

tech@jabber.belnet.be

jsminamr@openmailbox.org

mrlapis@exploit.im

airman@jabber.ru

neshpiter@jabbim.com

joke@blah.im

westup@codingteam.net

big@myempire.me

z@allinione.com

cuclusclan@allinione.com

mrgr@im.osmose-am.net

maracana777@exploit.im

daydate@im.apinc.org

scratch@jabber.belnet.be

cubon@thesecure.biz

mate@creep.im

nauthstuff@exploit.im

dozer@jabb.im

luke@suchat.org

mainqmac@jabber.cz

nadmin@pro-fi.net

nspacetex@jabber.cz

supp01@jabberx.biz
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supp08@xmpp.jp

supp17@exploit.im

supp37@cock.li

puusycat@jabber.ru

info@albfrrame.com

nsupport _miloff@exploit.im

nmilano1@default.rs

aizoo-adv@thesecure.biz

tmtforlifeqazbey@xmpp.jp

greenman@jabber.belnet.be

mikluchamaklai@jabb.im

chromehearts@jabber.ru

1. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEivEP_yNCd8SV4chFiw8alIS-8ZY7JJn_57hmMrYWT29OB9m

otCf-qeISAfyodfXkRIpaQjYa95smyzQJfTE1JQQoxXTD8xrIuYcyf

1.7.8 Sample Personally Identifiable XMPP/Jabber Accounts of the Gozi/Ursnif Malware Gang Team Members (2023-09-17 19:10)

[1]

Digging a little bit deeper into my ongoing research into various personally identifiable information such as for instance email address accounts and XMPP/Jabber account IDs belonging to cybercriminals I’ve decided to share a compilation of XMPP/Jabber account IDs known to belong to the Gozi/Ursnif malware gang team members with the idea to assist researchers vendors and organizations including U.S Law Enforcement on its way to properly track down monitor and prosecute the cybercriminals behind these campaigns.

Sample XMPP/Jabber account IDs known to have been involved in the campaign include: newjabber@jabbim.com

cash@allinione.com

slark@jix.im

sypress@wwh.so
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soft-rdp@xmpp.jp

merchant.official@xabber.de

merchant.official@jabbim.com

driesdtt@in.koderoot.net

npaplav000k@strong.pm

npaplav000k@xmpp.jp

cashsir@xmpp.jp

luke@allinione.com

nsky@allinione.com

adm@allinione.com

mrgreen@allinione.com

tech@jabber.belnet.be

jsminamr@openmailbox.org

mrlapis@exploit.im

airman@jabber.ru

neshpiter@jabbim.com

joke@blah.im

westup@codingteam.net

big@myempire.me

z@allinione.com

cuclusclan@allinione.com

mrgr@im.osmose-am.net

maracana777@exploit.im

daydate@im.apinc.org

scratch@jabber.belnet.be

cubon@thesecure.biz

mate@creep.im

nauthstuff@exploit.im

dozer@jabb.im

luke@suchat.org

mainqmac@jabber.cz

nadmin@pro-fi.net

nspacetex@jabber.cz

supp01@jabberx.biz

supp08@xmpp.jp
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supp17@exploit.im

supp37@cock.li

puusycat@jabber.ru

info@albfrrame.com

nsupport _miloff@exploit.im

nmilano1@default.rs

aizoo-adv@thesecure.biz

tmtforlifeqazbey@xmpp.jp

greenman@jabber.belnet.be

mikluchamaklai@jabb.im

chromehearts@jabber.ru

1. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhC4XKXNpz0fI9F-jGqMj006TStm79to6M3BYrnDVEPc_Uhw

9JcKVHJfyPz1likgQX-rcx6Uy1wboBPbTZmx41YrVNgvbxyTcYrXCI

1.7.9 OSINT Round-Up of Russia-Based High-Profile Cybercriminals (2023-09-18 13:17)

[1]

In my line of work in specific when doing research and analysis I always stick to a common concept which has to do with the fact that “everything that can be found has already been found somewhere online”. Sticking to this basic methodology the only thing an individual or a researcher has to do is to look up the facts including all the relevant and necessary technical information on the individual or case they’re working on and basically come up with a proper analysis relying on publicly obtainable and publicly accessible information on their topic of interest.

In this rather long OSINT analysis article I’ll do a OSINT roundup of Russia-based high-profile ransomware cybercriminals with the idea to share my research and analysis on the topic and potentially assist other researchers and vendors including U.S Law Enforcement on its way to properly track down and monitor and prosecute these cybercriminals.
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[2]

\I’ll begin this analysis with an emphasis and actual OSINT research and analysis on the Conti Ransomware Group in the context of demonstrating what real-time OSINT is which a pretty good and decent methodology that I’ve been relying and using over the years which works.

It all began with an internally leaked and made publicly accessible Conti Ransomware Gang’s internal communication where a security researcher or a set of security researchers appear to have compromised their internal server and have been collecting conversation logs between the cybercriminals which they later on made publicly accessible on Twitter in a specific for the purpose account that basically included direct download links to their internal communication.

From an OSINT perspective the first thing a researcher should do is to do their best to obtain access to these conversation logs and attempt to preserve them for current and future use which is something that I did almost immediately considering the possibility to monitor and track down who the actual individuals behind this massive ransomware campaign are.

The results? I’ve managed to successfully identify some of key individuals behind the Conti Ransomware Gang in terms of top management where my believe is that although it was a hired or outsourced “know-how” in the beginning quickly matured into a cybercrime enterprise where everyone who wanted to could join on a “franchise” based model and just do their work and earn fraudulently and maliciously obtained revenue from legitimate companies who are having their networks compromised and sensitive data and information made publicly accessible or basically encrypted in a way making it impossible for the actual organization and company to use.

What is the Conti ransomware gang up to in terms of top management? It appears that the gang’s top management in a way is involved in the fashion industry with the idea that some of the screenshots that I obtained and processed and analyzed which were leaked internally in the form of exchange of URLs between the gang’s members lead me to believe that the gang is involved in either investing in fashion brands or actually working on such with several successful public OSINT analyses on the topic where I’ve managed to identify some of the fashion brands behind the Conti Ransomware Gang’s top management and my goal here is to present the actual findings with the idea to bring this fact to more light in the context of providing information on the activity of the Conti Ransomware Gang’s top management members.

[3]
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[4]
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[5]
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[6]
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[7]
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[8]
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So basically once I came across their internal leaked communication made publicly accessible on Twitter I immediately aimed to obtain access to the leaked internal information of the Conti ransomware gang and preserve it before it goes online so that I can later on work with it and successfully produce the analysis including all the screenshots managed and operated by the Conti ransomware gang and here’s how I did it.

Basically once I obtained access to their internal leaked communication which was made publicly accessible I data mined the internal leaked communication looking for personally identifiable email address accounts and related URLs with success which is where I automatically visited these URLs which I data mined in the Conti ransomware gang’s internal leaked communication and basically grabbed all the live URLs information which is where the analysis and the screenshots including the actual report come from which I produced and have been working on to produce exclusively for fellow researchers and vendors including U.S Law Enforcement in order to assist everyone on their way to properly track down monitor and prosecute.

Sample Internally Leaked URLs Courtesy of the Conti Ransomware Gang Obtained Using Public Sources

There are several other fashion brand themed screenshots which I also managed to obtain which appear to be directly related to the Conti ransomware gang.

Here are some of the “upcoming brands” courtesy of the Conti Ransomware Gang obtained 1482



using real-time OSINT and relying on their internally leaked communications proving the gang including its top management is into fashion brands and the industry: Here’s some personally identifiable information on some of the brands using OSINT and public sources of information:

[9]

Leylo

Top Management Includes:

tel:+79126331303

[10]
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Мария Сергеевна Ермолаева/Maria Ermolaeva (Chudnova)

Birthday: 5 July

hxxp://vk.com/id7326657

Maria Ermolaeva

Birthday: 5 July

г. Екатеринбург, ул. Репина, 95, офис 116

Телефон: +7 (912) 633–13–03

Е-mail: info@leylo.ru

leyloekb@gmail.com

hxxp://leylo.ru/

[11]
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Danil Ermolaev

hxxp://vk.com/id4874860

Birthday: 7 August 1989

Sample Top Management Photos and Personally Identifiable Information of the Conti Ransomware Gang’s charity fund:

[12]
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Tamila Kerimova

Conti Ransomware Gang’s Top Management Team

hxxp://impulse-life.ru

Tamila Kerimova

— Birthday: 4 April 1986

— hxxp://vk.com/id6515862

— Planet for beauty and development

— hxxp://irinaverhusha.com

Тел: +7 926 536–63–68

Email: impulse.life2020@gmail.com

Sample Internally Leaked Screenshots Courtesy of the Conti Ransomware Gang: 1486



Sample Conti Ransomware Gang’s Internal Leaked Screenshots

Sample Related Internally Leaked Screenshots Courtesy of the Conti Ransomware Gang: Sample Conti Ransomware Gang’s Internal Leaked Screenshots

[13]

[14]
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[15]

[16]

[17]
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[18]

[19]
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[20]
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[21]
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[22]

Sample Conti Ransomware Gang’s Internal Leaked XMPP/Jabber Account IDs: LiamNeeson@jabber.ru
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arb _reserved@ubuntu-jabber.de

battletoad@jabbim.sk

begemot _sun@jabber.ru

crazy _digger@jabber.ru

gfh6776@jabb.im

ivanalert@jabber.ru

landslide@jabb.im

new _henry@jabber.cz

scopehope@jabb.im

ugly@1jabber.com

valerius2k@jabber.ru

vdx17@jabber.ru

337788@exploit.im

asteradminn@sure.im

benalen@exploit.im

bio@yax.im

crunch@exploit.im

daiverjm@exploit.im

dmanager@exploit.im

fuckUSAhahaha@exploit.im

fuckusa@exploit.im

gfh6776@jabb.im

goldcoin@exploit.im

jackiedugn@exploit.im

landslide@jabb.im

martiniden123@exploit.im

mr _loki@exploit.im

posi _tron@exploit.im

pravdazanami@exploit.im

rob0660@conversations.im

scopehope@jabb.im

soulst@exploit.im

time _t@exploit.im

trqa23rt@exploit.im

volhvb@exploit.im
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yastreb@exploit.im

SamCodeSign@xmpp.jp

alieelu@xmpp.jp

baton@xmpp.jp

batono@xmpp.jp

benalien@xmpp.jp

cosm123@xmpp.jp

graddds@xmpp.jp

guliver@xmpp.sh

liamliam@xmpp.jp

ohmygod728@xmpp.jp

[23]
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[24]
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[25]
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[26]

[27]
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Denis Gennadievich Kulkov

Personal Photo of Denis Gannadievich Kulkov
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[28]

Among the actual domains known to be part of the Try2Check cybercriminals enterprise include:

hxxp://try2services[.]pm

hxxp://try2services[.]cm

hxxp://try2services[.]vc

including the following domain:

hxxp://just-buy[.]it

including the following two ICQ numbers 855377 and 555724 and let’s don’t forget his personal email address accounts obtained using public sources which are polkas@bk.ru nordexin@ya.ru

[29]

and it doesn’t get any better than this as we’ve got a pretty good and informative domain portfolio registered by the same individual based on public information sharing the same domain registration details such as for instance hxxp://worldissuer[.]biz which actually are: 1500



hxxp://cloud-mine[.]me

hxxp://gpucloud[.]org

hxxp://hyperhost[.]info

hxxp://miservers[.]info

hxxp://carterdns[.]com

hxxp://reshipping[.]us

hxxp://keyserv[.]org

hxxp://antmining[.]biz

hxxp://investmentauditor[.]com

hxxp://sunnylogistics[.]us

hxxp://try2services[.]cm

hxxp://greatwallhost[.]net

hxxp://jaqjckugrfffqa[.]com

hxxp://numberoneforyou[.]net

hxxp://getprofitnow[.]biz

hxxp://avsdefender[.]com

hxxp://spyware-defender[.]com

hxxp://beta-dns[.]net

hxxp://mpm-profit-method[.]com

hxxp://public-dns[.]us — related including this

[30]

hxxp://adobe-update[.]net — Email:

krownymaradonna@onionmail.org related domains

known to have been involved in the campaign include — hxxp://amazon-clouds[.]com; hxxp://microsoft-clouds[.]net; hxxp://telenet-cloud[.]com; hxxp://vmware-update[.]com 1501





[31]

hxxp://kwitri[.]net

hxxp://dcm-trade[.]com

hxxp://karoospin[.]biz

hxxp://fastvps[.]biz

[32]

Evgeniy Mikhaylovich Bogachev

[33]

Sample Personal Photos of Evgeniy Mikhaylovich Bogachev:

[34]

1502



Slavik’s IM and personal email including responding IP:

bashorg@talking.cc — 112.175.50.220

Personal Address:

Lermontova Str. Anapa, Russian Federation

Instant Messaging account:

lucky12345@jabber.cz

Related name servers:

ns.humboldtec.cz — 88.86.102.49

ns2.humboldtec.cz — 188.165.248.173

Related domains part of a C &C phone-back location:

hxxp://slaviki-res1.com

hxxp://slavik1.com — 91.213.72.115

hxxp://slavik2.com

hxxp://slavik3.com

Slavik’s primary email:

luckycats2008@yahoo.com

Slavik’s ICQ numbers:

ICQ — 42729771

ICQ — 312456

Related emails known to have participated in the campaign:

alexgarbar-chuck@yahoo.com

bollinger.evgeniy@yandex.ru

charajiang16@gmail.com

Related domains known to have participated in the campaign:

hxxp://visitcoastweekend.com — 103.224.182.253; 70.32.1.32; 192.184.12.62; 141.8.224.93; 69.43.160.163

hxxp://incomeet.com — 192.186.226.71; 66.199.248.195
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hxxp://work.businessclub.so

Real Name: Galdziev Chingiz

Related domains known to have participated in the campaign:

hxxp://fizot.org

hxxp://fizot.com — 50.63.202.35; 184.168.221.33

hxxp://poymi.ru — 109.206.190.54

Related name servers known to have participated in the campaign: ns1.fizot.com — 35.186.238.101

ns2.fizot.com

Related domain including an associated email using the same name server: hxxp://averfame.org — harold@avereanoia.org

Google Analytics ID: UA-3816538

Related domains known to have participated in the campaign:

hxxp://awmproxy.com

hxxp://pornxplayer.com

Related emails known to have participated in the campaign:

fizot@mail.ru

xtexgroup@gmail.com

xtexcounter@bk.ru

Related domains known to have responded to the same malicious and fraudulent IP —

178.162.188.28:

hxxp://dnevnik.cc

hxxp://xvpn.ru

hxxp://xsave.ru

hxxp://anyget.ru

hxxp://nezayti.ru

hxxp://proproxy.ru

hxxp://hitmovies.ru

hxxp://appfriends.ru

hxxp://naraboteya.ru

hxxp://naraboteya.ru

hxxp://awmproxy.com

hxxp://zzyoutube.com

hxxp://pornxplayer.com

hxxp://awmproxy.net

hxxp://checkerproxy.net
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Related domains known to have participated in the campaign: hxxp://fizot.livejournal.com/

hxxp://russiaru.net/fizot/

Instant Messaging Account:

ICQ — 795781

Related personally identifiable information of Galdziev Chingiz: hxxp://phpnow.ru

ICQ — 434929

Email: info@phpnow.ru

Related domains known to have participated in the campaign:

hxxp://filmv.net

hxxp://finance-customer.com

hxxp://firelinesecrets.com

hxxp://fllmphpxpwqeyhj.net

hxxp://flsunstate333.com

Related individuals known to have participated in the campaign: Slavik, Monstr, IOO, Nu11, nvidiag, zebra7753, lexa _Mef, gss, iceIX, Harderman, Gribodemon, Aqua, aquaSecond, it, percent, cp01, hct, xman, Pepsi, miami, miamibc, petr0vich, Mr. ICQ, Tank, tankist, Kusunagi, Noname, Lucky, Bashorg, Indep, Mask, Enx, Benny, Bentley, Denis Lubimov, MaDaGaSka, Vkontake, rfcid, parik, reronic, Daniel, bx1, Daniel Hamza, Danielbx1, jah, Jonni, jtk, Veggi Roma, D frank, duo, Admin2010, h4x0rdz, Donsft, mary.J555, susanneon, kainehabe, virus _e _2003, spaishp, sere.bro, muddem, mechan1zm, vlad.dimitrov, jheto2002, sector.exploits

Related Instant Messaging accounts and emails known to have participated in the campaign: iceix@secure-jabber.biz

shwark.power.andrew@gmail.com

johnlecun@gmail.com

gribodemon@pochta.ru,

glazgo-update-notifier@gajim.org

gribo-demon@jabber.ru

aqua@incomeet.com

miami@jabbluisa.com

um@jabbim.com

hof@headcounter.org

theklutch@gmail.com

niko@grad.com

Johnny@guru.bearin.donetsk.au
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petr0vich@incomeet.com

mricq@incomeet.com

T4ank@ua.fm

tank@incomeet.com

getreadysafebox.ru

john.mikleymaiI.com

aIexeysafinyahoo.corn

rnoscow.berlin@yahoo.com

cruelintention@email.ru,

bind@ernail.ru

firstmen17@rarnbler.ru

benny@jabber.cz

airlord1988@gmail.com

bxl@hotmail.com

i _amhere@hotmail.fr

daniel.h.b@universityofsutton.com

princedelune@hotmail.fr

bxl _@msn.com

danibxl@hotmail.fr

danieldelcore@hotmail.com.

d.frank@jabber.jp

d.frank@0nl1ne.at

duo@jabber.cn

fering99@yahoo.com

secustar@mail.ru

h4x0rdz@hotmail.com

Donsft@hotmail.com

mary.j555@hotmail.com

susanneon@googlemail.com

kainehabe@hotmail.com

virus _e _2003@hotmail.com

spanishp@hotmail.com

sere.bro@hotmail.com

lostbuffer@hotmail.com

lostbuffer@gmail.com
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vlad.dimitrov@hotmail.com

jheto2002@gmail.com

sector.exploits@gmail.com

Aleksei Belan

[35]

Sample Personal Photo of Aleksei Belan

Sample domains known to have been involved in the campaign:

[36]
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Sample personally identifiable email address accounts known to have been involved in the campaign:

moy.yawik@gmail.com

moy-yawik@bk.ru

Sample known responding IPs known to have been involved in the campaign include: 77.221.159.235

62.76.182.72

62.76.190.68

185.50.25.13

104.18.41.143

198.54.117.212

104.18.40.143

Mykhaylo Sergiyovich Rytikov

[37]

Sample Personal Photo of Mykhaylo Sergiyovich Rytikov

Known domains affiliated with AbdAllah Internet Hizmetleri:

hxxp://tiket[.]cc

hxxp://abdulla[.]cc

hxxp://privateforum[.]cn

—

upomajuliya745@gmail.com;

xpj88kf@gmail.com;

316411856@qq.com

[38]
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Related known domains affiliated with AbdAllah Internet Hizmetleri: hxxp://ns1[.]srv4u[.]biz

hxxp://bulletproof-service[.]com — Email: support@hosting-offshore.biz — 202.83.212.250

hxxp://tarahost[.]net — Email: konstantin@karyaev.com — 89.108.73.93

[39]

Related domains known to have been registered by the same domain registrant: 1509

hxxp://all-mafia[.]net

hxxp://shampanskoe[.]info

hxxp://mashost[.]org

hxxp://flexi-domains[.]com

hxxp://5pagess[.]net

hxxp://extrasoft[.]biz

hxxp://golovolomka[.]info

hxxp://optical-coatings[.]info

hxxp://polevoi[.]info

hxxp://belorussia[.]info

hxxp://3alab[.]com

hxxp://prezervativ[.]org

hxxp://brodyaga[.]net

hxxp://skramedia[.]com

hxxp://tarafree[.]com

hxxp://mp3-mmf[.]com

hxxp://myproga[.]net

hxxp://extrahost[.]su

hxxp://garanthost[.]com

hxxp://grand-host[.]net

hxxp://technormativ[.]info

hxxp://xp-hosting[.]net

hxxp://kredits[.]cn

hxxp://tarahost[.]biz

hxxp://tarahost[.]org

hxxp://optical-coatings-design[.]info

hxxp://extrasoft-outsourcing[.]info

hxxp://pm-tost[.]net

hxxp://pm-sotovik[.]net

hxxp://pm-ranlix[.]net

hxxp://pm-holland[.]net

hxxp://swlu[.]info

hxxp://valdiss[.]info

hxxp://karyaev[.]com

hxxp://x450[.]info

1510

hxxp://grand-host[.]biz

hxxp://flexi-classifieds[.]com

hxxp://flexi-sitebuilder[.]com

hxxp://flexi-projects[.]com

hxxp://bloggast[.]info

hxxp://pereezd-pro[.]info

hxxp://eduaction[.]info

hxxp://wmnakovalnya[.]com

hxxp://retro80x[.]com

hxxp://tarafree[.]net

hxxp://skramedia[.]org

hxxp://oldactors[.]net

hxxp://tarahost[.]net

hxxp://janimation[.]net

hxxp://tarahost[.]com

hxxp://skramedia[.]biz

hxxp://vv-want[.]info

hxxp://skramedia[.]net

hxxp://olimp-sport[.]com

hxxp://youhouse[.]biz

hxxp://kroleki[.]com

hxxp://extrasoft-projects[.]info

hxxp://zelenaya[.]com

hxxp://cazinowm[.]com

hxxp://extrasoft-outsourcing[.]net

[40]
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Related domains known to have been involved with AbdAllah Internet Hizmetleri: hxxp://magic-jackpot-cas[.]com

hxxp://euro-vip-casino[.]com

hxxp://royal-casino-vip[.]com

hxxp://sexrusfuck[.]com

hxxp://royal-cas-vip[.]com

hxxp://2400-usd-casino[.]com

hxxp://royalcasino-vip[.]com

hxxp://2400usd-casino[.]net

hxxp://eurocasino-vip[.]com

hxxp://sinlife[.]cn

hxxp://byron-consulting-group[.]com

hxxp://28–07[.]com

hxxp://28–07[.]net

hxxp://job-consults[.]org

hxxp://837–86[.]org
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hxxp://expressdeal[.]biz

hxxp://cron[.]li

hxxp://crons[.]cc

hxxp://cronos[.]mn

hxxp://crinc[.]mn

hxxp://crinc[.]li

hxxp://ultrasmoke[.]cn

hxxp://supersmoke[.]cn

hxxp://globalsmoke[.]cn

hxxp://937–86[.]org

hxxp://cronco[.]li

hxxp://tradegroup-ha[.]com

hxxp://ha-tradegroup[.]com

hxxp://crinc[.]jp

hxxp://tradegroup-ha[.]net

hxxp://investmentcron[.]cn

hxxp://glb-soft[.]com

hxxp://croninv[.]cc

hxxp://cronis[.]cn

hxxp://crons[.]ac

hxxp://cronn[.]eu

hxxp://dkebooks[.]com

hxxp://cronoi[.]cc

hxxp://jieod[.]com

hxxp://midgejs[.]com

hxxp://crin[.]ac

hxxp://aoejf[.]com

hxxp://yseac[.]com

hxxp://kaserid[.]com

hxxp://crin[.]cc

hxxp://jekdoe[.]com

hxxp://ujeose[.]com

hxxp://masiwer[.]com

hxxp://reusiwe[.]com

hxxp://kaoeds[.]com

1513

hxxp://iwoser[.]com

hxxp://planet0day[.]biz

hxxp://xeirod[.]com

hxxp://neusoas[.]com

hxxp://geoepd[.]com

hxxp://efuyr[.]com

hxxp://ziude[.]com

hxxp://polsenstanford[.]com

hxxp://heyud[.]com

hxxp://woqkr[.]com

hxxp://seiudr[.]com

hxxp://aosier[.]com

hxxp://dueor[.]com

hxxp://crins[.]ac

hxxp://verbespecially[.]com

hxxp://fivejoy[.]com

hxxp://riverwomen[.]com

hxxp://trianglesentence[.]com

hxxp://floorside[.]com

hxxp://developtail[.]com

hxxp://womanfinish[.]com

hxxp://alwaysfell[.]com

hxxp://differcollect[.]com

hxxp://goodalso[.]com

hxxp://kingbrought[.]com

hxxp://findcharacter[.]com

hxxp://chanceexpect[.]com

hxxp://beardictionary[.]com

hxxp://forwardfield[.]com

hxxp://tinydown[.]com

hxxp://jobwhether[.]com

hxxp://numeralcity[.]com

hxxp://cronin[.]jp

hxxp://equalcatch[.]com

hxxp://streamwho[.]com
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hxxp://selectmonth[.]com

hxxp://propercame[.]com

hxxp://grewsoil[.]com

hxxp://townslip[.]com

hxxp://stationheavy[.]com

hxxp://charactereven[.]com

hxxp://milk0soft[.]com

hxxp://goldverb[.]com

hxxp://windowlisten[.]com

hxxp://bqgqnfc[.]cn

hxxp://wrbhnuw[.]cn

hxxp://a9da6[.]org

hxxp://04ccc408[.]org

hxxp://bdb7beb6[.]org

hxxp://scalespread[.]com

hxxp://thencloud[.]com

hxxp://figurespoke[.]com

hxxp://fullfraction[.]com

hxxp://propertytall[.]com

hxxp://beautyfig[.]com

hxxp://hadover[.]com

hxxp://followsalt[.]com

hxxp://staysay[.]com

hxxp://herexcept[.]com

hxxp://thanscore[.]com

hxxp://humanthus[.]com

hxxp://branchfelt[.]com

hxxp://areacountry[.]com

hxxp://meetduring[.]com

hxxp://movestood[.]com

hxxp://stillverb[.]com

hxxp://suggesteye[.]com

hxxp://preparebut[.]com

hxxp://hurrysound[.]com

hxxp://cookcompare[.]com
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hxxp://0daycod[.]biz

hxxp://europeansmoke[.]cn

hxxp://sprybog[.]net

hxxp://taybaol[.]com

hxxp://polsenstanford[.]com

hxxp://bconsgroup[.]com

GRU’s Unit 74455 “NotPetya”

[41]

Sample screenshots of the GRU’s Unit 74455 “NotPetya” malware gang obtained using public sources:

[42]

[43]
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[44]

[45]

[46]
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[47]

[48]

[49]

1518





[50]

[51]
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[52]

[53]

[54]
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[55]

[56]
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[57]

[58]

[59]

Igor Dehtyarchuk
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[60]

Sample Personal Photo of Igor Dehtyarchuk

Sample emails known to have been involved in the campaign include: abuse@shopsn.su

dimetr801@mail.ru

admin@4server.su

ssg.apple77@gmail.com

[61]

Sample domains known to have been involved in the campaign include: hxxp://4server.su
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hxxp://csgoacc.ru

hxxp://marketsales.su

hxxp://zarmo.su

hxxp://4domains.su

hxxp://ebayshop.su

hxxp://globus-base.su

hxxp://broshop.su

hxxp://deer.su

hxxp://shopsn.su

hxxp://cjmarket.net

hxxp://vkaccounts.com

hxxp://cheapaccounts.su

hxxp://ytuber.su

hxxp://vds4u.su

hxxp://4host.su

hxxp://tgshop.su

hxxp://xn — 227-qdd4dec.xn — p1acf

hxxp://4dedic.su

hxxp://time-hack.su

hxxp://4ns.su

Sample screenshot:

Oleksandr Vitalyevich Ieremenko

[62]

Sample Personal Photo of Oleksandr Vitalyevich Ieremenko

Handle: Zl0m; Lamarez; Ded.MCz; l@m@rEz

Email:

lamarez@mail.ru;

uaxakep@gmail.com

—

xeljanzusa.com

—

62.109.25.228

(hxxp://www.secureworks.com/research/point-of-sale-malware-threats); 62.109.1.69

Commpany: 2016 Кзерокс

1524

Phone: +7 951 366 17 17

ICQ: 123424

Web Money: 258807111393

Related URLs:

hxxp://ageline.ru/lamarez.php

hxxp://k0x.ru/md5.salt.tx

hxxp://k0x.ru/ _bot.exe — 82.146.60.59

hxxp://k0x.ru/black _energy _31337 _/stat.php

hxxp://k0x.ru/siicywu36dswh/addddos.php

hxxp://xtoolz.ru

hxxp://cup.su

hxxp://xwarez.us

hxxp://kinoafisha.ua/news/lamarez-was-here

hxxp://post-tracker.ru

hxxp://zr.ru

hxxp://business-gazeta.ru

hxxp://proshkolu.ru

hxxp://opengost.ru

hxxp://krokha.ru

hxxp://eurolab.ua

hxxp://newsdon.info

hxxp://dirt.ru

hxxp://anime-zone.ru

hxxp://rus.kg

hxxp://badger.ru

hxxp://fedpress.ru

hxxp://carsguru.net

hxxp://findfood.ru

hxxp://beboss.ru

hxxp://vidal.ru

hxxp://reghelp.ru

hxxp://rabotagrad.ru

hxxp://proshkolu.ru

hxxp://muztorg.ru

hxxp://mirf.ru
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hxxp://medgorodok.ru

hxxp://dobrota.ru

hxxp://cooksa.ru

hxxp://consmed.ru

hxxp://buro247.ru

hxxp://3dmir.ru

hxxp://novorus.info

hxxp://kidbe.ru

hxxp://eknigi.org

hxxp://2×2.su

Exante LTD — XNT Ltd. — exante.eu

Danil Potekhin

[63]

Sample personal Web site: hxxp://agressivex.com

[64]

Sample personal email: potekhinl4@bk.ru

Sample MD5 known to have participated in the campaign:

MD5: ecb347518230e54c773646075e2cc5ea269dcf8304ad102cee4aae75524e4736

Happy research!
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1. https://blogger.googleusercontent.com/img/a/AVvXsEi-URzHqqYfAkZ0m5QWaPdC52zr8446fcofGD_NXjLq5-MOoA_MBVUavj

ryDT2Mw1qb63Z5ZEXKDrNQxu9Y2oBQZ3CAjVVKIphJeO5RuUYjR9TV

2. https://blogger.googleusercontent.com/img/a/AVvXsEisvHUkcj8-PbmDR6BeqaSWtFH95mAdwdTNVBfTg6ToP-7IpdSAn8s2uj

HLg2zk6riy6gWhCRtddbA-7pm3YjbGTolwbLnb8qZagPE1AdIk0IDW

3. https://blogger.googleusercontent.com/img/a/AVvXsEiTKDl9Wf1tQ5SNHlm0e7f_tUPxgzVJvB82jD7jcTOSkvyNgk23j799Ny

kgMNAmj_99ObUvaFSuGm56Ql6Tu7sAXzoQtK46kZp_Gv220gCw3q8r

4. https://blogger.googleusercontent.com/img/a/AVvXsEhJAxAODBak1fqgAxx9FogJ-neUUQ0OSgUV4yLKspGaLggIVZdtz4YFJf

tkncQrxgUyRy9VMEdXc8FNSkooRIPPyPVVuMLtlD1meLdDwK2-RR3O

5. https://blogger.googleusercontent.com/img/a/AVvXsEiRrRerRXnMIJ44RZHIhUDqrbf0UnlZ5NIf4PHIDqWuHsX_W1AhR5C_Vk

UfFC416ZLlRSkd-5Be69neP9qkwM9ixV5CryfNz5-BCexxVqycBD8y

6. https://blogger.googleusercontent.com/img/a/AVvXsEjI6B05oVNTczzk_GP80SEP7nqTPbecqOtnMJjM5nLK-YwH0xOlDdgmKY

4xxdo3F78brdX0fFdtYJGmmQO1-CJRud7C6BzrDL64mvh-aEqYt_o1

7. https://blogger.googleusercontent.com/img/a/AVvXsEgHUeOg6RUX9Zyh4qRuf0RbWBLAI47lSGfH2jMu-9be4VELPzejX0eTcp

6A3jy0IdtyPOLopsCKHGfG7yeLZDLMosI11I9WTctL5AKOw-gMU0qR

8. https://blogger.googleusercontent.com/img/a/AVvXsEhxjgcpe1JhpJphkMFQZJLOjprVWJuN4qMfpBMiel4yE9A6OCZOMcHckA

x3h429hJRSIehOWn5tU9pzJRInN3DSxFcakSLWCesGVxTCLQAt9GyS

9. https://blogger.googleusercontent.com/img/a/AVvXsEhzVyNpyM0Df_hlUZkwFxZ4fSgBNR8G6lcV59jRYihFCsHlnM2aplVM1T

bUjDySPhhry9XIzDMR---6Dx08xbAQT2-tq5Hg3SzvBXXr5tFivTBO

10. https://blogger.googleusercontent.com/img/a/AVvXsEgY50WjQXLECQ-_-Da1eIofkRJUqya_550hRtwrC-PePlAKRv6csLuk

qgOmv6dbepPhBXPR1sv4WbWkmjBog23idYL07zbEoJjC5ySp3SBlxJFO

11.

https://blogger.googleusercontent.com/img/a/AVvXsEiw2IuGWbjccU3KMAX9-ZrDIUk2aaaqkRMa8ivmR_6pv0hDFseRrXO1

-EgjZmJiCRGDGGyU5AwSLxYgtBZ-a-v_XJnUzjzlJPC4kaKmGo-bY7BP

12.

https://blogger.googleusercontent.com/img/a/AVvXsEhonQfTDNUT-svoYi3CCcDrud1a2Aa3UjAS6TEyvrKAzsBYhGE0UaDn

I5VcSpf9uZ_J8vMgAeZRSoMKZsEC3T_ZFHGfMN0uxclRKFs6f75BsZSr

13. https://blogger.googleusercontent.com/img/a/AVvXsEgKua9w7Mwxm_rpY3CIZLV-_g49Bf3RLH-oN6hqkEFNXHax9kifsFoU

A48Qqwz5ATGW4D72fa1Fy7EszQ9zVrTIkiDOJtTymAVuz9BCPrF50Bvw

14.

https://blogger.googleusercontent.com/img/a/AVvXsEgpVKVeH8HlRSo5QwlKFgnHobTiFCvUki5AJ4A5IE8fVZUgRVK4Bk76

VOtMhR0U1tGNUDs7OeMzNNvCJ5fNeSLF1Hbph1pz18CvauLMMF6Nr6hq

15. https://blogger.googleusercontent.com/img/a/AVvXsEg3jgp-hc96zXjdzMRr0-0blIZeNKb2R7g2y9FuqwsWdstTKoI4UzG7

D3YA4fpClQsWp5OEGgk9-MxEMRPpMlI2Ve8Qlf0yo1Z9UOOS5ZKIqr-p

16. https://blogger.googleusercontent.com/img/a/AVvXsEiVzxPguwz-0lmybct1XR8gRApLu6MO8E_CbM0pdn-MxbAHEC6A9tLR

X2UPGKlXFWJrCupu19-3Felq86E2_pRATZLIkHPq0hHRsO_oBkkfWAU3

17.

https://blogger.googleusercontent.com/img/a/AVvXsEgWBs6956C1h8rk8yjWz_kDWOBpgwPe28dySZuyTgBCN-NaRwY7sa10

yy7ZdJ4MWivAiGhmKUeguZ_eRhjWvFKjcj7yCR7XMnb7OO7_SSy6N_W7

18.

https://blogger.googleusercontent.com/img/a/AVvXsEg6x6UclB_XFzej6Tl5bS3sKP9oeY5xSLYXFjO-8bWSda2fQKdrWtjg

1yfG1Fn8mS9dcmPO_b_DcvIzK9B4yCZ4XcTsCrA3vKDp78fhkGdCk3uw

19.

https://blogger.googleusercontent.com/img/a/AVvXsEiXYbELQD_D7bi8vC4a-UnSZtsEI4YYWS_Kd2lC6Fgrcs_3tTGB5pqv

jsA4r_KM3q5SnrZBZPpGYg6hk6SbyQCc5i7maPJ9tD7XCAw7YWdtW66r

20. https://blogger.googleusercontent.com/img/a/AVvXsEhrHpgW8fcB1ZgzHcUnxDuUP1SGpEe7RTiGcyY9KV3I-4T3CMNwAqVr

_EeDRHtXXUdCgAv035_iku0vTEHdVeXD7gpj5L3UHYEdsDnrvjInTIJe

21. https://blogger.googleusercontent.com/img/a/AVvXsEgFIRkcRR-dEkxNr6i_U3C1NvpNEIBtFL-ocg8fcTKMJ6XRrnuLm82E

_SYTGSKVOLmXKczqlH9DurhJ96t6bvK0QC3MkQ5zOfwMuvDrU5D-jYyr

22. https://blogger.googleusercontent.com/img/a/AVvXsEjSJpCJuV2M83Z3SQyuc7jJFXS9S-1ILZlG-u4629Chf6w6zUmrRl4n

CSWKLFhqLwNlQMGwQk9bMZ1VhTLVqQ-vddUFnIqEWO6U734hdSbn-aEg

23.

https://blogger.googleusercontent.com/img/a/AVvXsEgeAUeQWGuBQNVZ_krGFggN6FnAPAe4X6SNEMSHBpyvsknwpgxDNXLt

SFRUqavWqa3eEPq22DuzuWJ1btugY2iIUKhFozJ1N2jRMWqXkhrhw3Wj

24.

https://blogger.googleusercontent.com/img/a/AVvXsEhEufQvl2Q25aGY_FmRbcOgTbUSPpzEdstiFbFvL2obtV9LI5A9oWru

73SlHfFBjLq8MAE52u9oT-ap23uddm0US8MP4GshL-zntcegSyavUxox

25. https://blogger.googleusercontent.com/img/a/AVvXsEjTnRZkCtjf1J-NmA8uH6ciVg0llWZq1DXWa4O6J_hV3prHj3SXIB7l

1WqsIF4JC3-br-IEv-wSN_S5YLS0h7xOhyepRIYGArM_WSHXBAGDvosQ
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26.

https://blogger.googleusercontent.com/img/a/AVvXsEhVIhADneAe7jnUgivcx2fMUbo2hB6Ep8ZaaG55PPL1uVETQajJvtQ6

dfp5zbIK9cmqf8T4Ux8b1jjSGouZ158X7HziKYrpQbi6dlOeXIilJyPq

27.

https://blogger.googleusercontent.com/img/a/AVvXsEjj8hsIXL16qD92cW2QFVgjHTsTbnwJykkFjpnXd09ieiPs7t86ii_B

lbF5KBXICqctnSJ7640AApUAnfmLFmrshINRiQUJW4eeHqNGCb9r-kiI

28.

https://blogger.googleusercontent.com/img/a/AVvXsEjQjaTfRLE7jtblki_NI6MKi3s8h4xgKU6mdezTsPMKhPIAv4KYOloL

GGNjM1ASwcUaGJKYLwNxBkvwXLyYVunYbl2jXSOGvWau4Rrs5ggQXhr4

29. https://blogger.googleusercontent.com/img/a/AVvXsEhcwEN3zGevUJIMCKWEY9qXmzqsQlJByTME1CGnUXQP-PkiBbHhkllh

ClZz9rMKUn3MeekLIi1wWMeyd6QpOGpTUmoAbol5CLeJsk_dps28DfB_

30.

https://blogger.googleusercontent.com/img/a/AVvXsEjJVrlmTTLHXQL08XxYFbjJP1u_RQvUBl5RRt94kP2IbpnqlS683dUH

xBfFAXr-HxScKpXmQlhzmnbMB4Xdw4rkRl7TYmp3l86yVDyvvS6CHFET

31. https://blogger.googleusercontent.com/img/a/AVvXsEgmmNALIP_bAQbvf-27hkyqqAFrgOg_NyTNhkK-zcfCmoeE2-2IcZra

94jI31scB5_RdnpqwX5wddIAO-layAuJ22Ei78_apNCG8SmtXrYTZ6PH

32.

https://blogger.googleusercontent.com/img/a/AVvXsEgwo77Noz71gn3fASporpgy82ILMVklUOetPJX9QMipb0B5dNa9tqVX

4JEpmQ5b5fPObtiYi7H2mk4hEljJYW5KxGhIxRe03BrO0QNg8yHRvJ4Z

33. https://blogger.googleusercontent.com/img/a/AVvXsEiO6MQCY1aKSIZwK-MHGREp63gHzY51f1J-MDeIB1RQohlNh5GCo2TJ

T3WgmoQn8YVhiwLXGdS1soXogrnNsbXm-Tp5PHD5fHYwHupHOPql9UIj

34. https://blogger.googleusercontent.com/img/a/AVvXsEjpRp4RE_-6hYnfItiJqT-Afg1NaOv2_RqfU3O2PcyLdsPwd4snTm9q

x5Iv-J-jbD9a4cLONTbfcldRwcd2z4GcpB6bRXcRKkDJMquBVz1Tnz8M

35.

https://blogger.googleusercontent.com/img/a/AVvXsEjDbHX7vpR95jykrwzxFSgGoEFOf0aaCJrzxnmZnhnQPpc2WmLC5JRa

KPLHGSVz4bHR7SCAzLdIuDRUHcP39iB4pAyQyMTO2Yq4jrRsVwBm4LW4

36. https://blogger.googleusercontent.com/img/a/AVvXsEiH9bboz-ruhlc7G_1e-Fm1G2CINbjpgV6Z-pqPHAEv0xuh5ljIf4ne

VHqwo0f3AKrVP21bSUKzdbTG6kLXVcIosmHtxMN7WNsr-BAoAz0LxY_a

37. https://blogger.googleusercontent.com/img/a/AVvXsEguDTBD7HdD4fyUhPGSkcHvWC-fuZj7yE1BLXkUD0L4xD7vekL38fBu

hOuhVzAaPUGHusdEk5CZTDjhJ_ZfzqM3aMJ9DLcGjPRS7kWyju5zCR6z

38.

https://blogger.googleusercontent.com/img/a/AVvXsEhQC0C81jKV24k4pPYGPnXq-IuG64h49V9N5S3lmqsq8Iw6vRL__2Q_

dU1eFwXh8ompM-mcoulphg5JJDzlQyCU_OK2QI7P7bLqSODLcNn1cnW2

39. https://blogger.googleusercontent.com/img/a/AVvXsEjZNu4_S7aL_-aJ4NW9BQCbUCWwACBw86gPFKGs8qNB-o1e9YChZoPr

1THZ7kmZnp5KHVUVxQamVC9DjDxvcwEId-flUImJjfxZvm6v1s_pILaF

40.

https://blogger.googleusercontent.com/img/a/AVvXsEiw1oakeZcZjmaR9BmuTAjVkgnOzOQiXe12zeY_odI6g5ibfGSwdQ9P

ik-Mcyll_MEiTNKDd4r6Ld9PSzlvx7OdCJBlP6kviKaeorD6GGPMAIY7

41.

https://blogger.googleusercontent.com/img/a/AVvXsEiKdJyS4n6ObKEu8Bu3mYsxcptUjGMpss_r3TJWGT3SSVifvga5_Ntq

9zCHUlnEwMIrYxh-gL2S5Ol_JL3wlvW5s_F6VYMCpPRBBUYLR5KbE64E

42. https://blogger.googleusercontent.com/img/a/AVvXsEjhr7W356xRWl-lAivZICpNcTz7mOTs0Utc-n8MNlgbfhtkM3h8pGEC

orx3AP2DUJ-31oNolAcn3CQSSax4yLgqZAh_CdPJnY64V2YpK8l2HnzX

43. https://blogger.googleusercontent.com/img/a/AVvXsEjN-5zAgd-FxuxLqPPt1I4NgfbsFkzwcPTMxvAZrUAwuECNAZPLqHZL

GwMfV8z6eWjDG9h3wpfL8iTi64IBaWsIkwvuFL3CGslk9753N1ogjbxV

44.

https://blogger.googleusercontent.com/img/a/AVvXsEhBnPSJ-1XS_1uegjUd8jMMg3JNEyH6DPmXhx215XhswYdayWfjuzeQ

yojTpv_U6Oqf_kQMhabfeijAiZnOc_lVMYh_jHEMSnrkKWHGLyiWMQra

45.

https://blogger.googleusercontent.com/img/a/AVvXsEixlZUT2kWwmDZ3KDnrH-gLpDzMYp0SN4aLjiCaMXVpJdbwMAHWMOUu

0xBRh07Njv83sGO2dp3JiwQ3ytkaqHtvVT2cLQNduJrdx2uKNEGd-Mp2

46.

https://blogger.googleusercontent.com/img/a/AVvXsEjgdFD7ldT-pKtgwpYeVc4ofvZycUuSmntm2yJ5gbl2HovYUwuvtWcw

-35tKyU_WrGh0mc8e8pvBVlJT-yplzfDqpkJEYqThNbiz3i5ESeuAqlw

47.

https://blogger.googleusercontent.com/img/a/AVvXsEjnwKbPR__6YE4874SOEYZaoHg206aw3zF1dOCfBJL248O426knRiw1

6IN_gIu49ttFYC8VqNax5G-trl9r8ZvVCFcsO0oifYF_wyPga28p_2l4

48.

https://blogger.googleusercontent.com/img/a/AVvXsEiBk5A3syygYuWML19VGRaLHVkPCPVrpx0a8JSJ1mshXVqGi8tCeiU9

AICdAN427A5K2Da9zrgkKSpz_toQaMEp7FE8pPyjsGVZcRAvX2QJSY71

49.

https://blogger.googleusercontent.com/img/a/AVvXsEiKEOZysPQ55Ud__GrV4JPZJVCUok7FjOA2z07l8mkeeET2wnt-CyDo

b8aQXhOocSj-sHm66brDx9wlnPOfb9STsDbY6CJEHFICatStGGKy2FUT

50. https://blogger.googleusercontent.com/img/a/AVvXsEiFo0hN4H7tYMHmHDTLhv5AnzcBc_l4N-csyiZcw0NOZRPVCEB9ZgsC

X7lhq6VwWvj_iE9UDdTwg-ShwgWYC4czCHt4dALe1K6JpZteegHkoXk4
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51.

https://blogger.googleusercontent.com/img/a/AVvXsEj1WEEffGYeiqJjAVBqGxnD1zMM3hDWx1JxV212uYFEYvV5FM7Xjjw7

I9HK33PUG-iGqTpafe4RVoD-sH03onMVp21gkMjj75SgMjzcbkj2vlcn

52. https://blogger.googleusercontent.com/img/a/AVvXsEgmoHvPVHQe_nF1T0IIxuKGxcWVmdo38LQuTnfVE8NJiLXq2-7Vielw

IFZi1o9NhmAWuyKcEet9aoErKcBkEDSKf5Zs3anBQA0UbjqEh1rxq28s

53.

https://blogger.googleusercontent.com/img/a/AVvXsEjZdri3axgzLW3EF7qopQdX6J0hEwnYQc1rV1aG5fPzVxFi1cmPF318

dovXanTxgM_v7odN8GZxuUrYR3IZxE089eBRuUoZ8XrFPwzDrJzAkH-v

54.

https://blogger.googleusercontent.com/img/a/AVvXsEjISKl_HV9HoEhwaTCyvRlxCk21Ehgpvf1RwNiMuVhiYlyYgClgEXTJ

oPhKhgf_ufB0yUOAo3AlPrZ3TfOldu-CG6dr6QhVvupsvHWk4469OieU

55.

https://blogger.googleusercontent.com/img/a/AVvXsEh3aKzCYlWh4wBzMLhE70PrFFvp85f0GGql3_YOLRS9SvrDGdzeGh84

fl_bUpYXqtWLvLKhOVThMIWJnCXkmoP2QU1AO5k3q2jEvDPeiO_bzSrf

56. https://blogger.googleusercontent.com/img/a/AVvXsEgZjDV5yI_Fci9EmRFDCScluHH_RrvxVf0s0r8hU58-A1OMoVU_HA68

6Vo1_Q45zm5mMFOytAGXtGVvq2OfXkm4cLkH1CC0eFTVp-Bpk2TmjoDn

57.

https://blogger.googleusercontent.com/img/a/AVvXsEgTUXDPEZ40oBxktchPIIA81eyW0KUf0yepBSNfmbCuW9TDx7UhHXqo

jm1_jSxSQM8tebUxd0V1FPQa-yX34PBti-j879nPxJGXCcfUfYgEmQGD

58.

https://blogger.googleusercontent.com/img/a/AVvXsEizyBujYJFlKVeFsVgUOW6bSH7ruGEI7zKtYLluM8pxne042f0ecyVi

YCo8eKv5_3CEG2yHF6QftX6ASinUiL4xS3NUbqFKwMnPEmAdwiD4nSAO

59.

https://blogger.googleusercontent.com/img/a/AVvXsEgepCNyvOK94KuK_ou3e7Nzr_0yoPDCcnCMVC0rHUNxGUx8oOSsbZuR

zu1bVObiCjtYOj92fE3mO2KTj-EzLXt_GEg9blY_cxgrsC7zNFBJ-XOy

60. https://blogger.googleusercontent.com/img/a/AVvXsEjPDCxrsxrmIfyGzQh-yx3GJvOoNmhh-jIEKwStp-OG7_QKGofmsdvH

_z1WvNQkG6R_4WgjPIXayISoJpMuv9s7gKdM1k440t31EVUiqKJnOwL1

61. https://blogger.googleusercontent.com/img/a/AVvXsEjyOoZ_JgvUlzcZW0jbioKTRpHVrCrVCB-XzkEqgR0go5YY1mpNCZxV

oWTVJpdqW-CgHFFkJ-8WkLppqFFsK4V21QayZ59IMUBTPrrTysNcuJMj

62.

https://blogger.googleusercontent.com/img/a/AVvXsEgy8lRCxdapxCI8Kk7v2HV9E6ILBC94mMTWhtpXyq67QmIPzABJP9Ri

Ww8jHiZkOet7i2IKyZPa8A43xssL9z20lpSzDrva_x5lOQFBn4nt3Wjd

63.

https://blogger.googleusercontent.com/img/a/AVvXsEgObLK17UKsK7smwR3PkoFxGVr1Z9LwBTfJC7YzCoIB_Wfh7cmvupqE

gIbCBjsQTuuY3H33GAsIA8NbOnhV4UkpZD0ByONVickF5YH2h_9Acm2S

64.

https://blogger.googleusercontent.com/img/a/AVvXsEjutXbDf3O2kr8ATLH1ThLlKsXzyR5XsBHCVijdXOZs9uPCmskIB3Qa

JggiVoHKInMcdGbSStA_RUFBHeHq9elVuTv8w2_2ZgUV2--hzzv9e62e

1529



1.7.10 Exposing the Bulgarian Cyber Army Cyber Threat Actor (2023-09-18 13:28)

[1]

Anonymous Bulgaria is your typical Anonymous “franchise” Anonymous hackers model where you have a group of people doing web site defacements and compromises of legitimate web sites and infrastructure and actually blame a bigger cause that they don’t really have anything to do with and don’t understand or know anything about it.

The ultimate goal here would be for the group to gain momentum including to attract followers where the ultimate goal would be to spread a message that they don’t often understand or have anything to do with low profile DDoS attacks or cyber attack attempts similar and typical to the Anonymous hackers collective idea.

Is it script kiddies or low profile wannabe hacker groups that basically have one social media account and are capable of launching low profile cyber attack attempts that often make the news or is it a bigger conspiracy where everyone doing the same can outsource their responsibility for doing it to the entire “idea” which basically represents an Anonymous set of people attempting to do low profile cyber attack attempts?

[2]

1530





Let’s go for the first part.

The important part when dealing with this type of low profile threat actor is to usually keep track of their activities including social media profiles and activity and look for additional clues in terms of current and ongoing cyber attacks and most importantly look for additional clues such as personally identifiable information which would be later on used in a possible cyber threat actor attribution campaigns including for the actual enrichment of this PII for the purpose of looking for additional clues in terms of doing threat actor infrastructure reconnaissance on your way to look for additional clues such as related malicious and fraudulent including cybercrime activity including domains personally identifiable email address accounts or related social media accounts.

[3]

The ultimate goal when collecting these would be yo either build a database of the threat actor in question which could lead to a possible commercial or community driven project venture 1531



or to assist fellow researchers and Law Enforcement on its way go track down monitor and prosecute these individuals.

[4]

In this article I’ll discuss in-depth the Anonymous Bulgaria hacker franchise that basically just like many other Anonymous franchises across the globe basically represent low profile cyber attack attempts type of threat actors and will provide personally identifiable information on their online whereabouts.

[5]
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Some of the other Bulgarian Web site defacement groups that are known to work and coop-erate with Bulgarian Cyber Army include BG Worm, MTH Soft, Hack3D TeaM and EvilHack and Anonymous Bulgaria.

[6]
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What’s specifically interesting about Bulgarian Cyber Army is that the group appears to be still and currently active and operational based on some of their latest web site defacement and Facebook activity.

Personally Identifiable Information on Bulgarian Cyber Army:

hxxp://facebook.com/hack3dteam

hxxp://vimeo.com/user16145338/videos

Personally Identifiable Information on Hack3d Team:

MaStErHaCk

Slackera

Tiger

RTFM

Sspdf11

PanteliX
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Metalqear

MaStErChO

W!PS

TraferA

3ikmy

r00tkit

The Godfather

razora911

Personally Identifiable Information on EvilHack:

EvilHack[.]hmamail.com

anonyops[.]abv.bg

genadi _100[.]abv.bg

evil _hack[.]abv.bg

evilhack[.]bk.ru

evilhack000[.]gmail.com

clangrf[.]abv.bg

hxxp://anonymous-world.free.bg

hxxp://web-dangerous.free.bg

hxxp://evilhack-official.blogspot.com/

Personally Identifiable Information on Anonymous Bulgaria:

NoTolerance

Hades

PsychoPatternz

rootheR _

hxxp://anonbg.info

1. https://blogger.googleusercontent.com/img/a/AVvXsEgX5Wq4KYuk2gI-VV1Mlb0aIpfeElU2AVBkGcO2PbuGfqWP6Tr-5CFjVj

Ghq7Y7RUfxuA_MFAUNYJf_NXmDWMi6iZ3bUE6VzUv85nUuoulP8_l_

2. https://blogger.googleusercontent.com/img/a/AVvXsEicOHcu-9Z4PVRjxms2kNPbNPPR4aiEkyGaSpZQLuak2og7cXE315r98U

4NnF_NReQprmheNgLg4FmPEVrnAwwQgjL6lJQynUMxKG2vdLgbd-nc

3. https://blogger.googleusercontent.com/img/a/AVvXsEiqS-x_vt6XN9xtg-bGSBj5DdHBUV52JgN3pytE8KDM_nyIOJErSVjVZV

PdJk4AyD7a7yIOMA4bLYpAfDRQQrdRufOaitlDFVHl9hU5uTQj6FqM

4. https://blogger.googleusercontent.com/img/a/AVvXsEiANz6-FYJNcd5oENlyszdFml5sssa_OEgNjAunUdJKFHqcJFdKol_pOF

ysiAU5qr4R2wzkNG12PtX3ufu3vdjMmvHv2RMlx9LMbAvacaNC-LSP

5. https://blogger.googleusercontent.com/img/a/AVvXsEgyRFhUqMAAoEeELegKD9Jo6IQEgZfHxnZQOj-cebLIvWrayAolPqCs8d

sE_qKszpb9brxq9_EtZajOFSLZMALPr2Rwov9ehZ39-eQK2RAJfA6o

6. https://blogger.googleusercontent.com/img/a/AVvXsEgpcETNMK8PGp5ZrSMuSkF6pJouVmI1RtIhOYhltbhqSk9D5is-YmgLwl

ac_U2H1QqwN5bbIhlQuuk5JO22tdToibm3a65XLhneFWdbX3rpiV1F
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1.7.11 Applying for the Rewards for Justice on the Conti Ransomware Gang Program (2023-09-18 21:08)

[1]

Dear blog readers,

This is Dancho and I have some news. I just applied for the United States Rewards for Justice program on the Conti Ransomware Gang and I identified myself with my research and analysis.

[2]
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Wish me luck.

[3]

1537



Stay tuned.

1. https://blogger.googleusercontent.com/img/a/AVvXsEjZKl9pIITkKIeyDtfH15F5ZaFtMKRSkHkWgy9k_2JL4_b0-LiDy2WodZ

3AGGHB2hFSh33-3eV055SlxDyCQdxJv-eauDnWYE6VfcQ106Q04YSo

2. https://blogger.googleusercontent.com/img/a/AVvXsEij5F-Red_iuet01Fkx21TCydrPLvYgExka--EGmvalYK2v5bsKwrqyrL

HPSNhAaxr-1bcYc43WjxYjPjl2LLsDrrE11v6_RkOBOohzRhbkzT3x

3. https://blogger.googleusercontent.com/img/a/AVvXsEikotIV3_kT3MSINwuxN4ehfnBa2OAyP959YJdFfWx4UyoAdPhirxHuKu

H29ufQa-xFLVJHhlCHypBdhm49rhMnZOg1BqF-MzKuiuKbVa0hm4RG

1.7.12 Yavor Kolev - Part Two (2023-09-18 21:39)

[1]

Dear blog readers,

Are you in a desperate need to reach out to someone who’s basically the exact definition of a toilet person? Is it the taste or is it the smell? Is it the desperate need or the promise for something cool and interesting?

Let’s start from the basics by defining the terms. Just what exactly a toilet person is? A toilet person but correct me if I’m wrong since I don’t mean to be weird knowing this is someone supposedly thinking that first of all the toilet is a cool thing and most of all since the person is supposedly thinking he’s also cool he should either buy a toilet or live and work there. In a toilet? A toilet through the perspective of a toilet person is an entire universe and let’s don’t forget a supposedly something that although he wouldn’t understand at the beginning an entire dimension.

A second logical question emerges? Is the very bottom of your pathetic and moronic existence and should the very spitness and social vomitness of your irrelevant social existence set an example for others?

The answer is no.

Stay tuned!

1. https://blogger.googleusercontent.com/img/a/AVvXsEhzIp-RfYWpOhPSgZxWBw3YausW2mP4boSmkyC8Uce35cpNEuWMpa2Gav

_yh9GIvH3GCkU2-RrbpZBleRXLX-X-5WLezQl-OJ0VhOnDc-Hv4Uxn
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1.7.13 A New DIY Grim Android Botnet Spotted in the Wild (2023-09-19 00:45)

[1]

I just came across to a newly released DIY Android Botnet with some pretty interesting built-in features including the use of mobile-based ransomware device locking capability including to offer the attacker the capability to take full control of the Android device for various purposes.

Sample screenshots:

[2]
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[3]
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[4]
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[5]
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[6]

[7]
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[8]

[9]
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[10]
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Sample description:

Sending SMS.

Launch USSD.

Application launch.

Change URL admin panel/Redirect.

Get all SMS.

Get all installed apps.

Launch Fake- Locker .

Getting Keyloggera logs.

Getting numbers from the phone book.

Send SMS to your contacts.

Enable Ransomware

Turn off Ransomware

Automatic display of PUSH Notifications.

Show PUSH Notification.

Launch SMS spam.

SMS interception.

Hidden interception of SMS.

Show message box.

Get a list of received permissions.
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Request permissions for injections.

Request permissions for Geolocations.

Launch RAT/VNC.

Microphone recording.

View/Manage the File System.

Follow the screen.

Request all rights

Start call forwarding.

Stop call forwarding.

Open link in browser.

Open hidden link in browser.

Delete application.

Launch SOSKS5.

Stop SOSKS5.

Get the bot’s IP.

Enable PUSH.

Disable PUSH.

Auto-delete applications.

Smart lock function.

Works on all versions from 5 to 10.

Hidden SMS interception works from 5 to above.

Injections work on all current versions 5 – 10.

The data between the servers and the bot is encrypted.

Bot deletion blocking.

Lock disabling rights.

Blocking the disablement of the Accessibility Service.

May have several spare domains, for otstuk.

About 600+ injections for all countries/banks/cryptocurrency

Disables Play Protect. Once disabled, it cannot be enabled.

The unique identifier of the bot.

ANDROID version/Smartphone name.

Picture marking.

Country + language that is set in the settings.

The last retreat.

Status of Google Play Protect.
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Screen status on/off.

Injection rights state.

Status of the Accessibility Service.

Status of covert interception of SMS.

Status of permissions for geolocations.

Availability of bank logs, mail cards.

List of established banks.

Device IP.

The date the device was infected.

Operator.

phone activity.

Bot time.

The cost of bot licenses.

1 month – $ 500

3 months – $ 1000

12 months – $ 3000

1. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgmejEo3QSIF7j-jehGFnQu4zL7ntJhffg9fpkEF6AUYOCBV

yn1PErC2ysh0NtWZErH7KdjUxRE1-r6yjAUHezQu_yNkXrYuHMbbAS

2. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg2BOGFtZey8oc79ydkdxVKhFjffcWhCizbLkWlu9qpajJ9S

lyRgbXLaHlgdR5CSTNAgGvOAvu1TLknfMfkyF7vfL400CQsnZ4PWg9

3. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi713eXkw4aKy5iPuFjYlovZ1_AaOSbbYORPOHYORATLVnvN

grYhBMnX5o6M_H8E3RQ6sqiunFoKY2hx85IyfMqhq0mBBTnpamPnH2

4. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgOUffwQoGL0MoX1G4OVjDvYifrN0TDkDwsWkLkPwazwGtMo

O2n-DvrQ_GFjFQcmSCii5CmJD8PVCkxFFci6OrlYPPGjlkySqbYWPF

5. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiUsyyljMh25kZmEZ8Mhm7M9mphzl4RANwK4MYuks8oOElCt

aTZEwkHQ70dntWA9MhvA8qQ_6JUVFRgyk0syFzfPmnxuLlR27-mlI0

6. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEikgdlm3_nUJkTtcON1QtCCJqwg9wODhSG-xnqi9FwK3DNp3

N3PHvvaokw4Lr0_3Ja9YsV8OAum9UIfcW8kqTBtI4ZBBbQyG0Ea77p

7. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEje9d6B3vK6MCHeXDs0kd1sK2VtKB28KHroK4VlO5cNQTmIP

VuW5bUA6Zo3_sG1KJ8OWnXidMnX8SEMilDYwMbgP4t4mdwr9gysZwc

8. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjQI7dqnSiPU34OUAuGywOPPa487lHhOiztE_I0CeSI_a39r

-P2Uvm-V1MBv3GjJL1v7378hEu-zMRfDBXGdAv0Sx-iWPVVUS13x0Q

9. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhiFNCXJ6psjEWrL4kt1GZRQ7boOowWnbXQKjUNk4WIdfA2u

sfuQ3QCRGnfSJ-Ze6lTBcgRhJZ6AzIyvl2bMOa7mvZmXv-bbHkppvu

10.

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjoAqW2nQ9UGFOZ3pdE4GzxNiJmfal0FN8aT-WrvFypqVI

ZdsJAFZjyEKK7zSfMLn5w1AW7ybw-NKbwT6keJjen4l7yS7uStKuG7ZJ

1.7.14 A New CINOSHI Cryptocurrency Stealing Malicious Software Spotted in the Wild (2023-09-19 00:45)

[1]
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I just came across to a newly released cryptocurrency stealing malicious software as a service cybercrime ecosystem proposition which has a lot of cryptocurrency and related accounting data stealing capabilities.

Sample screenshots:

[2]

Sample description:

Cinoshi — это MaaS (Malware-as-a-Service) проект, который предоставляет своим

клиентам функционал стиллера, ботнета, клиппера и майнера. Весь ранее озвученный

функционал находится в одном билде и поддерживает работу со всеми устройствами с

операционной системой Windows. Легко поддается крипту, а также имет ряд полезных

функций, которые не дадут вашим логам / ботам пропасть в неизвестной бездне. Мы
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очень много времени уделили оптимизации билда, идеальной работе проекта, а также

системе автоматической замены прокладок. Все это для того, чтобы вам было удобно

работать с вашим трафиком!

Функционал Stealer:

— сбор паролей с браузеров на устройстве жертвы

— сбор куки файлов с браузеров на устройстве жертвы

— сбор десктопных криптокошельков и расширений с браузеров

— сбор всей информации о устройстве (компьютере) жертвы

— сбор сессий Steam (сбор ssfn и vdf файлов)

— сбор токенов Discord (поддержка множества популярных клиентов)

— сбор сессий Telegram (сбор по динамическим путям)

— сбор данных с файлового клиента WinSCP (сбор с реестра)

— сбор данных с файлового клиента FileZilla (сбор с recentservers.xml)

— сохранение скриншотов каждого монитора с компьютера жертвы в лог

— рекурсивный сбор файлов с рабочего стола и папки документов

— отображение фейковой ошибки (текст ошибки и названия окна настраивается на

панельке)

— защита от виртуальных машин, песочниц, Virustotal, Any.Run и дедиков (настраивается

на панельке)

— домен-детектор для поиска нужных линков в паролях и куки (фильтры для

domaindetect-a настраиваются на панельке)

— сбор лога осуществляется в памяти (снижение рантайм детектов)

Функционал Clipper:

— подмена 9-ти криптокошельков в буфере обмена на ваши

— подмена трейд ссылки Steam на вашу

— получение кошелька с сервера происходит каждый раз, то есть при смене кошелька

все уже установленные клипперы начнут заменять на новый адрес

Функционал Botnet:

— запись в автозапуск Windows

— добавление в исключения Windows Defender-а

— выполнение команд с панели (скачать и запустить файл)

— возможность проливать несколько файлов одновременно

— возможность указать уникальное количество запусков

— возможность получения гостевой ссылки со статистикой (подойдет для продажи

инсталлов)

Функционал Miner:

— полная настройка майнера прямо с панели (облачная настройка, при смене кошельков

или настроек вам не придется менять билд майнера)
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— добавление в исключения Windows Defender-a, а также отключение обновлений

безопасности Windows

— возможность отключения майнера в полноэкранном режиме, чтобы боты не палили

майнер играя в игры

— поддержка двух монет одновременно: Monero на процессоре, Ethereum Classic на

видеокарте

— автоскрытие/автовыход при открытии диспетчера задач.

Подписки:

Cinoshi $99 - месяц [Поддержка по любым вопросам, панель, Stealer, Botnet, Miner, Clipper, обновления]

Стоимость подписки навсегда обговаривается лично.

1. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjo_4c1GNE0csgK_lUkrgg92SKdrcJWxXTjk44KXLH2Vm2um

5gzenikGUscwjYc-NVTsLNyaddBmoCHVu4fTNqSKQ2mfOVMFOzHcxr

2. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEghghY0sVsfuNzNlv0u0KcnnwUg-fP5n9aukmT-YrRLqVOda

pYkfk3eLshiuKNgtQ2WZZFxsKyK6xkADDK1EcGNWpbgQrmpxU4LW5x

1.7.15 A New X-Files Accounting Data Stealer Spotted in the Wild (2023-09-19 00:45)

[1]

I just came across to a newly released accounting data stealer known as X-Files. Priced as a managed service on a monthly based subscription starting at $120 - 1 Month. $650 - 6 Months.
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(bonus after the update) $1250 - 12 Months. (bonus after the update) which covers a variety of different and unique cryptocurrency stealing and grabbing approaches.

Sample screenshots include:

[2]

[3]

[4]

[5]
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[6]
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[7]

[8]

[9]
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[10]

[11]
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1. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhak3NMZMAcoY5c0QaShjlxG5Uu-b_gtwXzHXQsAjhanfg9x

i3jV0nNjRDlf0SFcPXgQmR-D4-Ssw7FeaghQJkec6Sss3GOp_CTNCv

2. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgUM1oMiBuY-Kf3kETQRv_HQfH6voclgKaQ1Poqek8LHOVNC

HIQPkQ7mv7Wubxdg_I3TKc-8ryyAmK-YMouLqyRUJibpjs0b1OhDj_

3. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgjZsKOruTiuY4kB1yY5uo7b7dDv2AZTwCrL23BuFdTKoTPO

7zr6ekeRlGETqPR460eVz-uhr3pENzMJ_sZYQMIQUqEURMbsLvf5Yg

4. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgQyrxLtzzon3s7JG--mEZNsKROOFdTZnb_F9EH9c1I__ENT

44p3V-Mtjmro55B7cWyJxsf6AecfJLGEpKiy0VuliHHs2wU1rdkbKf

5. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiapws--TnGhPraD3_dEBjJtQxCic04USrQdM3UhrUgFyxlV

NLC6c72DQt1B-F8yXdOYynidee_w6e3fMtoefg-LaPbWma5NqSRIt4

6. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjzBZ_6SbgYPJ5VGApc3lkhuKoFeki3F-XIzS8-7iQktCCR8

bPhlU56SqJ-jwnjcArf7FgPVYPRXpvU4Z96EBpBdJ-Kml2w69zDXsR

7. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiT64ve5ozFW7d67PzvWegp-MPYSEknuqm2znzRoSImz-XH_

6Px4nKNmMXOtW4xk2r7CLRmE79Xdrc5RXoOfByup3Xkb3IRof5iTJ4

8. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg9k2qI2Bsj-tR4Hedtuwe1XPb79lTK9uJ26rQBrLG6y-Lqr

Df9enH854nibTgVih3TxHn9gG0rDTKAzKQBy1RmlUtZa01eu6A4Uxe

9. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgbepWnqNdUJDjrQGw1Xh6Cj5rnfF1oRmTEmI1H5WlKGFNlg

V52CyP5vBD3F0vHfSQHLxeybO1h8BOHjUxgwODwzaL_l271qnZSTLZ

10.

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi9lDGByrWRhsrD_LTvbzzRqL4MBXZVKC-g0JUMjemM9L9

aWArm3exbcMgsSnYYiFTntne-A-QFavlcpKQ_rUdl_wUHxSGAt21vF7g

11.

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh2q_XiDhBDFgrqenoeOb9dBQaeaubu6GJLeh_YhQ0O0hN

wsIblGEnPSaMyVhV5Zp1gA4acIBigrBkm_dUQK6Uivxzz1LJYGMGIsNF

1.7.16 A New Kristina CS DIY Ransomware Spotted in the Wild (2023-09-19 00:45)

[1]
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I just came across to a new DIY ransomware offered within the cybercrime ecosystem. Priced at $2,500 it also offers something I haven’t seen in a while in specific for a ransomware cybercrime ecosystem proposition namely its self-propagating features.

Sample description:

Этот билд не безызвестный криптолокер/вымогатель/шифровальщик, шифрует все

файлы ПК за исключением файлов Windows не нарушая работы системы "клиента"

ПК/сервера.

Данная схема заработка серая, прибыль зависит исключительно от Вас и уделенного

времени и составляет от нуля кто ничего не делает до бесконечности.

Данный билд никогда не работал и не будет работать по РФ и странам СНГ, это наше

неотъемлемое кредо.

ТТХ и возможности KristinaCS:

- разработан на высокоуровневым языке, метод шифрования AES 256;

- работает на всех версиях Windows начиная с 2003 года, x84/x64 и так же Server;

- высокая скорость шифрования обеспечена частичным шифрованием файла;

- шифрует все диски и сьемные носители во время шифрования (флеш карты, sd карты

и так далее);

- при запуске определяет локальную сеть, шифрует носители сети;

- возможность выбора определенного шифруемого диска или сьемного носителя;

- возможность выбора количества поток шифрования, рекомендуемые параметры ПО

задаст самостоятельно, в зависимости от производительности ПК/Сервера;

- не трогает необходимые файлы и папки Windows для продолжения работы ПК/Сервера;

- при шифровании происходит полная перезапись файлов поверх,

что делает

практически не возможным организовать восстановление данных с помощью R-studio и прочими продуктами;

- полностью офф-лайн шифровальщик, при работе не требуется ваше присутствие;

- после шифрования заменяются обои на рабочем столе и во всех корневых папках

создаётся текстовый документ с инструкциями, а так же заменяет название всех файлов

на адрес эл. почты для связи;

- есть функция расшифровки любого файла на выбор, что бы ваш "клиент" мог убедиться

что вы обладаете такой возможностью;

- процесс шифрования происходит в режиме HIDE и не позволит "клиенту" обнаружить

его, после окончания продукт автоматически удаляется с ПК/Сервера клиента, так же

присутствует данная функция на дешифраторе, тем самым вам не нужно следить за

процессом и после "заметать" следы;
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Варианты сотрудничества с нами:

1) Условно бесплатная (Распространение):

При такой схеме Вы становитесь распространителем,

получаете бесплатно от

нас шифровальщик KristinaCS L (L- locker), привязанный на нашу почту, который

распространяете самостоятельно.

Схема работы следующая:

Ваши "клиенты" связываются с нами, мы общаемся, выставляем свои фиксированные

требования в размере 300 usd.

После получения выгоды от вашего "клиента" мы выплачиваем Вам 70 % от полученных

средств. Выплаты производятся раз в неделю, каждую пятницу, только на ваш кошелек

BTC.

Стоимость продукта: 0usd

2) Продажа билда (Ручная версия):

При полной покупке, вам полностью передается ПО привязанную на вашу почту, для

самостоятельной работы. Таким образом вам открываются следующие возможности:

- самостоятельно общаетесь с "клиентами", контролируете процесс от и до;

- самостоятельно устанавливаете размер вашей выгоды с "клиента", отставляете

возможность торга, а так же способ получения;

- появляется возможность собрать собственную команду распространителей, при

которой самостоятельно назначаете условия работы с ними;

В комплект KristinaCS входит:

- KristinaCS L - непосредственно сам локер/шифровальщик привязанный на вашу почту, которая будет отображаться на всех шифрованных файлах для связи с вами, а так же

на обоях рабочего стола и в текстовых файлах в каждой папке. Ручная версия подходит

для распространения по RDP и прочих способов, кроме спама;

- KristinaCS D - дешифратор файлов;

- KristinaCS K - генератор ключа для дешифратора;

Стоимость продукта: 1000usd

3) Продажа билда (Автоматический старт);

Все те же самые возможности и комплектность как в пункте 2, за исключением что

данная версия предназначена для распространения по средством спама.

Стоимость продукта: 2500usd

Дополнительные услуги:

- мануал по бесплатной схеме сотрудничества - бесплатно;

- мануал по работе билда - бесплатно;

- мануал по способам распространения и безопасности - бесплатно;

- обновления ПО - бесплатно;

- замена эл.адреса на для тех кто работает по схеме 2 и 3 - стоимость 200usd;

- аренда сервера с установленным ПО для брута RDP - стоимость 100usd в месяц; 1558



- платное обучение работе, по работе с ПО, по безопасности индивидуальное либо

в небольших группах для тех кто не смог разобраться в мануалах самостоятельно -

стоимость 100usd;

Работа через гарант данной площадки приветствуется, за наш счет.

Все взаиморасчеты с нами только по средством BTC.

1. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgxJF6H79W5znpoFGtRjfAa-eI-AHV9wE6OZ2bs04_2ePHWN

fJeZNhXy0FLp2unqTWwo_-2HyDVVexVY-6FcxcgcBTOXZOmsyyGYTY

1.7.17 New Images Courtesy of the Conti Ransomware Gang (2023-09-20 13:26) Dear blog readers,

I decided to share with everyone yet another screenshots portfolio courtesy of the [1]Conti ransomware gang based on their leaked internal communication which I obtained using my methodology.

What’s specifically interesting about the first image is the mentioning of the [2]morenehost bulletproof hosting provider including a dance and teaching school initiatives including the usual fashion brand initiative courtesy of the gang.
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Sample screenshots include:

[3]

[4]
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[5]
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[6]
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[7]

[8]
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[9]
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[10]
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Stay tuned!

1. https://ddanchev.blogspot.com/search?q=conti

2. https://intel471.com/blog/top-bulletproof-hosting-providers-yalishanda-ccweb-brazzzers-2021

3. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhlN96T9AnGBncgAOiDkWEaZTkIdrjGe9H8vsFkogkErCjjY

fgXzBx_k3rX4hMJ9PWRGsedwFNciYPPKaAG4-ZdBGayVg99KBqnIsK

4. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj8ELsIWknldq-WC2jqwmPqfRzJHHHpcDjvJtXYbbLBJ4Gv3

Yp0m-7MdaQI8XuBjjIzQqeQXm3LBah_jKsT7Rx30cstNBnbIz7dod4

5. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgGYfitQB8ouaO_i_3Fl32JDwHyf0Ph_Q-RSrMy1gAvqLvDZ

AOHlCN8kSrOC5IAIyQwxBFSYXJZTlHZzfhFSTe-uGmJhiu2dwaWJDM

6. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiFV2yImxLjjC3TS8pNDPaH_fuUNuOjilsyuOqFZbGgNKbuU

K6ng7RDZ42LkT1A-X2xE0NmL7xtHCR-fJynjdyKayf-4p7xf4-lihD

7. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjlJS56ZczJlUEb52VJsiODAxqhgqz1iaMP5FxVJVC_qa88d

MNHYBkKEpBq8dGws-chWrBG_XRCyl_jMVdkY-FEPku_scYs-nCeSA6

8. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjKY_XCfu65VYt0WE0MAPCtQ68QmXpVBRFbzWacs5jVkdV_k

vrlGH0-LjgRjTw45iBz5f6zL9wYKvIjXe-0mhHKSQWPRPSZ_ya8lkg
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9. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjwLOR4ACcHJi10aeV2wq-OsddHgjiqhpMVu1cl7q7VzW6jU

2l0erbdUtGa5YQ-H-hGtJr15z_3NKKoOMd70SVlW_BSFsvuiUBO_wk

10.

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgkvcjDpR31LgUru9oqgspzvEPuTcjJDU1loz4jef7rQGN

HrXs8sRLpjNPSCQoPITVo3DyFqpJtQKeVsYskr2LLI1mQytL-0l2Za0i

1.7.18 Yavor Kolev - Part Three (2023-09-21 19:34)

[1]

What’s the main difference between a Bulgarian and the rest of the world? It’s vomit. It’s the vomit that sometimes unites us and it’s the vomit that sometimes separates us.

In this case. It’s the end of the line and goodbye.

Stay tuned!

1. https://blogger.googleusercontent.com/img/a/AVvXsEiny14xWJpVxWfnA0J1nKfqKUQhULzIbvYczHq6nNqOeEGcdkRdnwmnIM

lGQiEw3SNbWSSQjPY3YdkKVPg_SG2uuZBKEVK8wzZj5YdMRZuM0hPT
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